DORA simplified RMF

Requirement description

The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall design and implement, where appropriate, a procedure governing the acquisition, development, and maintenance of ICT systems following a risk-based approach. That procedure shall:

(a) ensure that, before any acquisition or development of ICT systems takes place, the functional and non-functional requirements, including information security requirements, are clearly specified and approved by the business function concerned;

(b) ensure the testing and approval of ICT systems prior to their first use and before introducing changes to the production environment;

(c) identify measures to mitigate the risk of unintentional alteration or intentional manipulation of the ICT systems during development and implementation in the production environment.

How to fill the requirement

Article 37: ICT systems acquisition, development, and maintenance

Task name

Priority

Status

Theme

Policy

Other requirements

Approval process before deploying new software

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

System management

Data system management

requirements

Examples of other requirements this task affects

1.3.4: Use of approved software

TISAX

ID.RA-09: Reviewing hardware and software

NIST 2.0

Article 37: ICT systems acquisition, development, and maintenance

DORA simplified RMF

See all related requirements and other information from tasks own page.

Go to >

Approval process before deploying new software

1. Task description

Organisation has a process to review and approve software before installation or use. Process includes at least:

Assess limited approval: Verifying if the software is approved for specific use-cases or roles within the organization.
Check conformance: Ensuring the software meets the organization's information security requirements.
Verify software use rights and licensing: Confirm that the software has the appropriate licensing for its intended use.
Evaluate source and reputation: Assess the credibility and reputation of the software vendor or source.

This process should include the selection of special purpose software e.g. maintenance tools.

Testing of new systems before deployment

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

System management

Data system procurement

requirements

Examples of other requirements this task affects

Article 37: ICT systems acquisition, development, and maintenance

DORA simplified RMF

See all related requirements and other information from tasks own page.

Go to >

Testing of new systems before deployment

1. Task description

New systems must be tested and approved before they are used and before they are added to production environment.

There should be measures in place to mitigate risk of unintentional alteration or intentional manipulation of systems during development and implementation.

Security rules for the development and acquisition of data systems

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

System management

Data system procurement

requirements

Examples of other requirements this task affects

Članak 30.1.e: Sigurnost u nabavi, razvoju i održavanju mrežnih i informacijskih sustava

NIS2 Croatia

4.2: Tietojärjestelmien hankinnat

TiHL tietoturvavaatimukset

9.3 §: Tietojärjestelmien hankinta ja kehittäminen

Kyberturvallisuuslaki

5.3.1: Information Security in new systems

TISAX

13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus

TiHL

See all related requirements and other information from tasks own page.

Go to >

Security rules for the development and acquisition of data systems

1. Task description

Whenever new data systems are acquired or developed, pre-defined security rules are followed, taking into account the priority of the system. The rules ensure that adequate measures are taken to ensure the security of the data and data processing in the system.

Tasks included in the policy

Task name

Priority

Status

Theme

Policy

Other requirements

No items found.

38: Kiberuzbrukumu attiecināšana

NIS2 Latvia

1.1 (MIL2): Manage IT and OT Asset Inventory

C2M2

1.1 (MIL3): Manage IT and OT Asset Inventory

C2M2

1.1.1: Availability of information security policies

TISAX

1.1.1: Identify the organisation’s strategy and priorities

NSM ICT-SP

1.1.2: Identify the organisation’s structures and processes for security management

NSM ICT-SP

1.1.3: Identify the organisation’s processes for ICT risk management

NSM ICT-SP

1.1.4: Identify the organisation’s tolerances for ICT risk

NSM ICT-SP

1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions

NSM ICT-SP

1.1.6: Identify information processing and data flow

NSM ICT-SP

1.1: Establish and Maintain Detailed Enterprise Asset Inventory

CIS 18

1.2 (MIL2): Manage Information Asset Inventory

C2M2

1.2 (MIL3): Manage Information Asset Inventory

C2M2

1.2.1: Establish a process to identify devices and software in use at the organisation

NSM ICT-SP

1.2.1: Scope of Information Security management

TISAX

1.2.2: Establish organisational guidelines for approved devices and software

NSM ICT-SP

1.2.2: Information Security Responsibilities

TISAX

1.2.3: Identify devices in use at the organisation

NSM ICT-SP

1.2.3: Information Security requirements in projects

TISAX

1.2.4: Definition of responsibilities with service providers

TISAX

1.2.4: Identify the software in use at the organisation

NSM ICT-SP

1.2: Address Unauthorized Assets

CIS 18

1.2: Manage Information Asset Inventory

C2M2

1.3 (MIL2): Manage IT and OT Asset Configuration

C2M2

1.3 (MIL3): Manage IT and OT Asset Configuration

C2M2

1.3.1: Identification of information assets

TISAX

1.3.1: Identify the users of the information systems

NSM ICT-SP

1.3.2: Classification of information assets

TISAX

1.3.2: Identify and define the different user categories

NSM ICT-SP

1.3.3: Identify roles and responsibilities linked especially to ICT security

NSM ICT-SP

1.3.3: Use of approved external IT services

TISAX

1.3.4: Use of approved software

TISAX

1.3: Manage IT and OT Asset Configuration

C2M2

1.3: Utilize an Active Discovery Tool

CIS 18

1.4 (MIL2): Manage Changes to IT and OT Assets

C2M2

1.4 (MIL3): Manage Changes to IT and OT Assets

C2M2

1.4.1: Management of Information Security Risks

TISAX

1.4: Manage Changes to IT and OT Assets

C2M2

1.4: Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory

CIS 18

1.5 (MIL1): Management Activities for the ASSET domain

C2M2

1.5 (MIL2): Management Activities for the ASSET domain

C2M2

1.5 (MIL3): Management Activities for the ASSET domain

C2M2

1.5.1: Assessment of policies and requirements

TISAX

1.5.2: External review of ISMS

TISAX

1.5: Management Activities for the ASSET domain

C2M2

1.5: Use a Passive Asset Discovery Tool

CIS 18

1.6.1: Reporting of security events

TISAX

1.6.2: Management of reported events

TISAX

1.6.3: Crisis preparedness

TISAX

10 §: Johdon vastuu

Kyberturvallisuuslaki

10. Processing of personal data relating to criminal convictions and offences

GDPR

10.1 (MIL2): Establish Cybersecurity Program Strategy

C2M2

10.1 (MIL3): Establish Cybersecurity Program Strategy

C2M2

10.1.1: Policy on the use of cryptographic controls

ISO 27001

10.1.2: Key management

ISO 27001

10.1.2: Key management

ISO 27017

10.1: Continuous improvement

ISO 27001

10.1: Cryptographic controls

ISO 27001

10.1: Cryptographic controls

ISO 27017

10.1: Deploy and Maintain Anti-Malware Software

CIS 18

10.1: Establish Cybersecurity Program Strategy

C2M2

10.2 (MIL2): Establish and Maintain Cybersecurity Program

C2M2

10.2 (MIL3): Establish and Maintain Cybersecurity Program

C2M2

10.2: Establish and Maintain Cybersecurity Program

C2M2

10.2: Configure Automatic Anti-Malware Signature Updates

CIS 18

10.2: Non-conformity and corrective action

ISO 27001

10.3 (MIL1): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL2): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL3): Management Activities for the PROGRAM domain

C2M2

10.3: Disable Autorun and Autoplay for Removable Media

CIS 18

10.3: Management Activities for the PROGRAM domain

C2M2

10.4: Configure Automatic Anti-Malware Scanning of Removable Media

CIS 18

10.5: Enable Anti-Exploitation Features

CIS 18

10.6: Centrally Manage Anti-Malware Software

CIS 18

10.7: Use Behavior-Based Anti-Malware Software

CIS 18

10: Cryptography

ISO 27001

10: Cryptography

ISO 27017

10: Cybersecurity Program Management (PROGRAM)

C2M2

10: Prosessi väärinkäytöksiin reagoimiseksi

Digiturvan kokonaiskuvapalvelu

11 §: Poikkeamailmoitukset viranomaiselle

Kyberturvallisuuslaki

11. Processing which does not require identification

GDPR

11.1.1: Physical security perimeter

ISO 27001

11.1.2: Physical entry controls

ISO 27001

11.1.3: Securing offices, rooms and facilities

ISO 27001

11.1.4: Protecting against external and environmental threats

ISO 27001

11.1.5: Working in secure areas

ISO 27001

11.1.6: Delivery and loading areas

ISO 27001

11.1: Establish and Maintain a Data Recovery Process

CIS 18

11.1: Secure areas

ISO 27001

11.2.1: Equipment siting and protection

ISO 27001

11.2.2: Supporting utilities

ISO 27001

11.2.3: Cabling security

ISO 27001

11.2.4: Equipment maintenance

ISO 27001

11.2.5: Removal of assets

ISO 27001

11.2.6: Security of equipment and assets off-premises

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27017

11.2.8: Unattended user equipment

ISO 27001

11.2.9: Clear desk and clear screen policy

ISO 27001

11.2: Equipment

ISO 27001

Requirement description

How to fill the requirement