DORA simplified RMF

Requirement description

1. The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall include in their simplified ICT risk management framework all of the following:

(a) a determination of the risk tolerance levels for ICT risk, in accordance with the risk appetite of the financial entity;

(b) the identification and assessment of the ICT risks to which the financial entity is exposed;

(c) the specification of mitigation strategies at least for the ICT risks that are not within the risk tolerance levels of the financial entity;

(d) the monitoring of the effectiveness of the mitigation strategies referred to in point (c);

(e) the identification and assessment of any ICT and information security risks resulting from any major change in ICT system or ICT services, processes, or procedures, and from ICT security testing results and after any major ICT-related incident.

2. The financial entities referred to in paragraph 1 shall carry out and document the ICT risk assessment periodically commensurate to the financial entities’ ICT risk profile.

3. The financial entities referred to in paragraph 1 shall continuously monitor threats and vulnerabilities that are relevant to their critical or important functions, and information assets and ICT assets, and shall regularly review the risk scenarios impacting those critical or important functions.

4. The financial entities referred to in paragraph 1 shall set out alert thresholds and criteria to trigger and initiate ICT-related incident response processes.

How to fill the requirement

Article 31: ICT risk management

Task name

Priority

Status

Theme

Policy

Other requirements

Creating and maintaining incident response plans

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Incident management

Incident management and response

requirements

Examples of other requirements this task affects

4.1.1: Establish plans for incident management

NSM ICT-SP

ID.IM-04: Incident response and cybersecurity plans

NIST 2.0

PR.IR-03: Meeting resilience requirements

NIST 2.0

RC.RP-01: Recovery plan

NIST 2.0

RS.MA-01: Incident response plan execution

NIST 2.0

See all related requirements and other information from tasks own page.

Go to >

Creating and maintaining incident response plans

1. Task description

The organization should create and maintain incident response plans. The response plans should include at least:

Incident or the type of incident for which the plan has been made
Goal for plan
Responsible persons and related stakeholders and contact information
Planned immediate actions
Planned next steps

Defining security events and incidents

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Incident management

Incident management and response

requirements

Examples of other requirements this task affects

1.6.1: Reporting of security events

TISAX

DE.AE-08: Incidents declaration criteria

NIST 2.0

17.9: Establish and Maintain Security Incident Thresholds

CIS 18

Article 31: ICT risk management

DORA simplified RMF

See all related requirements and other information from tasks own page.

Go to >

Defining security events and incidents

1. Task description

Organisation must develop a clear, comprehensive definition of what constitutes a reportable security event or observation, ensuring it covers the following categories:

Personnel misconduct or misbehavior.
Intrusion, theft, unauthorized access to security zones, and vulnerabilities in security zones.
Cybersecurity incidents such as vulnerabilities in IT systems, and detected successful or unsuccessful cyber-attacks.
Supplier and partner incidents that could negatively impact the security of the organization.

Organisation must have a defined procedure for reporting of incidents and it should be communicated to the personnel:

Design and implement effective reporting mechanisms tailored to perceived risks.
Ensure these mechanisms are well communicated and accessible to all employees, stakeholders, and relevant parties to facilitate timely and accurate reporting of security events.
Conduct training sessions and awareness programs to ensure that all relevant employees and stakeholders understand the definition of reportable security events and are familiar with the reporting mechanisms.

Enabling asset-based risk management in the ISMS

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Risk management and leadership

Risk management

requirements

Examples of other requirements this task affects

Article 8: Identification

DORA

2.5: Riskienhallinta

TiHL tietoturvavaatimukset

5.2.2: Seperation of testing and development environments

TISAX

1.1.3: Identify the organisation’s processes for ICT risk management

NSM ICT-SP

Article 31: ICT risk management

DORA simplified RMF

See all related requirements and other information from tasks own page.

Go to >

Enabling asset-based risk management in the ISMS

1. Task description

The organisation must enable asset based risk management from the ISMS settings.

Asset-based risk management should be set to cover all needed asset types with high enough criticality. The asset based risk management should be used at least for:

System providers
Data systems
Data stores
Other stakeholders
Other assets

Monitoring the status of risk management

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Risk management and leadership

Risk management

requirements

Examples of other requirements this task affects

14.5.2): Aukščiausiosios vadovybės atsakomybė

NIS2 Lithuania

19: Riskienhallinan tilanteen seuraaminen

Digiturvan kokonaiskuvapalvelu

CC5.1: Control activities for mitigation of risks

SOC 2

Article 6: ICT risk management framework

DORA

2.5: Riskienhallinta

TiHL tietoturvavaatimukset

See all related requirements and other information from tasks own page.

Go to >

Monitoring the status of risk management

1. Task description

Implemented risk management measures and the overall situation of risk management are checked regularly.

The operating model for monitoring the status of risk management is clearly described.

Continuous improvement of the risk management process

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Risk management and leadership

Risk management

requirements

Examples of other requirements this task affects

21: Riskienhallintaprosessin kehittäminen

Digiturvan kokonaiskuvapalvelu

21.2.a: Risk management and information system security

NIS2

Article 6: ICT risk management framework

DORA

1.4.1: Management of Information Security Risks

TISAX

8 §: Kyberturvallisuutta koskeva riskienhallinnan toimintamalli

Kyberturvallisuuslaki

See all related requirements and other information from tasks own page.

Go to >

Continuous improvement of the risk management process

1. Task description

The organization has an operating model for continuously improving the functionality and efficiency of the risk management process.

In the improvement, it is possible to use e.g. general standards (e.g. ISO 27005) or feedback from people involved in risk management.

Tasks included in the policy

Task name

Priority

Status

Theme

Policy

Other requirements

No items found.

38: Kiberuzbrukumu attiecināšana

NIS2 Latvia

1.1 (MIL2): Manage IT and OT Asset Inventory

C2M2

1.1 (MIL3): Manage IT and OT Asset Inventory

C2M2

1.1.1: Availability of information security policies

TISAX

1.1.1: Identify the organisation’s strategy and priorities

NSM ICT-SP

1.1.2: Identify the organisation’s structures and processes for security management

NSM ICT-SP

1.1.3: Identify the organisation’s processes for ICT risk management

NSM ICT-SP

1.1.4: Identify the organisation’s tolerances for ICT risk

NSM ICT-SP

1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions

NSM ICT-SP

1.1.6: Identify information processing and data flow

NSM ICT-SP

1.1: Establish and Maintain Detailed Enterprise Asset Inventory

CIS 18

1.2 (MIL2): Manage Information Asset Inventory

C2M2

1.2 (MIL3): Manage Information Asset Inventory

C2M2

1.2.1: Establish a process to identify devices and software in use at the organisation

NSM ICT-SP

1.2.1: Scope of Information Security management

TISAX

1.2.2: Establish organisational guidelines for approved devices and software

NSM ICT-SP

1.2.2: Information Security Responsibilities

TISAX

1.2.3: Identify devices in use at the organisation

NSM ICT-SP

1.2.3: Information Security requirements in projects

TISAX

1.2.4: Definition of responsibilities with service providers

TISAX

1.2.4: Identify the software in use at the organisation

NSM ICT-SP

1.2: Address Unauthorized Assets

CIS 18

1.2: Manage Information Asset Inventory

C2M2

1.3 (MIL2): Manage IT and OT Asset Configuration

C2M2

1.3 (MIL3): Manage IT and OT Asset Configuration

C2M2

1.3.1: Identification of information assets

TISAX

1.3.1: Identify the users of the information systems

NSM ICT-SP

1.3.2: Classification of information assets

TISAX

1.3.2: Identify and define the different user categories

NSM ICT-SP

1.3.3: Identify roles and responsibilities linked especially to ICT security

NSM ICT-SP

1.3.3: Use of approved external IT services

TISAX

1.3.4: Use of approved software

TISAX

1.3: Manage IT and OT Asset Configuration

C2M2

1.3: Utilize an Active Discovery Tool

CIS 18

1.4 (MIL2): Manage Changes to IT and OT Assets

C2M2

1.4 (MIL3): Manage Changes to IT and OT Assets

C2M2

1.4.1: Management of Information Security Risks

TISAX

1.4: Manage Changes to IT and OT Assets

C2M2

1.4: Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory

CIS 18

1.5 (MIL1): Management Activities for the ASSET domain

C2M2

1.5 (MIL2): Management Activities for the ASSET domain

C2M2

1.5 (MIL3): Management Activities for the ASSET domain

C2M2

1.5.1: Assessment of policies and requirements

TISAX

1.5.2: External review of ISMS

TISAX

1.5: Management Activities for the ASSET domain

C2M2

1.5: Use a Passive Asset Discovery Tool

CIS 18

1.6.1: Reporting of security events

TISAX

1.6.2: Management of reported events

TISAX

1.6.3: Crisis preparedness

TISAX

10 §: Johdon vastuu

Kyberturvallisuuslaki

10. Processing of personal data relating to criminal convictions and offences

GDPR

10.1 (MIL2): Establish Cybersecurity Program Strategy

C2M2

10.1 (MIL3): Establish Cybersecurity Program Strategy

C2M2

10.1.1: Policy on the use of cryptographic controls

ISO 27001

10.1.2: Key management

ISO 27001

10.1.2: Key management

ISO 27017

10.1: Cryptographic controls

ISO 27001

10.1: Cryptographic controls

ISO 27017

10.1: Deploy and Maintain Anti-Malware Software

CIS 18

10.1: Establish Cybersecurity Program Strategy

C2M2

10.1: Non-conformity and corrective action

ISO 27001

10.2 (MIL2): Establish and Maintain Cybersecurity Program

C2M2

10.2 (MIL3): Establish and Maintain Cybersecurity Program

C2M2

10.2: Establish and Maintain Cybersecurity Program

C2M2

10.2: Configure Automatic Anti-Malware Signature Updates

CIS 18

10.2: Continuous improvement

ISO 27001

10.3 (MIL1): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL2): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL3): Management Activities for the PROGRAM domain

C2M2

10.3: Disable Autorun and Autoplay for Removable Media

CIS 18

10.3: Management Activities for the PROGRAM domain

C2M2

10.4: Configure Automatic Anti-Malware Scanning of Removable Media

CIS 18

10.5: Enable Anti-Exploitation Features

CIS 18

10.6: Centrally Manage Anti-Malware Software

CIS 18

10.7: Use Behavior-Based Anti-Malware Software

CIS 18

10: Cryptography

ISO 27001

10: Cryptography

ISO 27017

10: Cybersecurity Program Management (PROGRAM)

C2M2

10: Prosessi väärinkäytöksiin reagoimiseksi

Digiturvan kokonaiskuvapalvelu

11 §: Poikkeamailmoitukset viranomaiselle

Kyberturvallisuuslaki

11. Processing which does not require identification

GDPR

11.1.1: Physical security perimeter

ISO 27001

11.1.2: Physical entry controls

ISO 27001

11.1.3: Securing offices, rooms and facilities

ISO 27001

11.1.4: Protecting against external and environmental threats

ISO 27001

11.1.5: Working in secure areas

ISO 27001

11.1.6: Delivery and loading areas

ISO 27001

11.1: Establish and Maintain a Data Recovery Process

CIS 18

11.1: Secure areas

ISO 27001

11.2.1: Equipment siting and protection

ISO 27001

11.2.2: Supporting utilities

ISO 27001

11.2.3: Cabling security

ISO 27001

11.2.4: Equipment maintenance

ISO 27001

11.2.5: Removal of assets

ISO 27001

11.2.6: Security of equipment and assets off-premises

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27017

11.2.8: Unattended user equipment

ISO 27001

11.2.9: Clear desk and clear screen policy

ISO 27001

11.2: Equipment

ISO 27001

Requirement description

How to fill the requirement