← Frameworks / EU DORA / Control Mappings

EU Digital Operational Resilience Act (2022/2554)

EU regulation establishing uniform requirements for ICT risk management, incident reporting, digital operational resilience testing, and ICT third-party risk management across financial entities. Covers banks, insurers, investment firms, crypto-asset service providers, and critical ICT third-party providers. Requires threat-led penetration testing (TLPT) and comprehensive ICT third-party oversight.

Controls: 200

Total Mappings: 345

Publisher: European Union Version: 2022/2554

EU DORA → SP 800-53 SP 800-53 → EU DORA Coverage Analysis

AC (19) AT (6) AU (12) CA (9) CM (11) CP (12) IA (9) IR (9) MA (7) MP (7) PE (3) PL (9) PM (4) PS (9) PT (2) RA (8) SA (14) SC (24) SI (15) SR (11)

AC Access Control

Control	Name	EU DORA References
AC-01	Access Control Policies and Procedures	Art.5(1)Art.6(1)Art.9(4)(c)
AC-02	Account Management	Art.9(4)(c)Art.9(4)(d)
AC-03	Access Enforcement	Art.9(4)(c)
AC-04	Information Flow Enforcement	Art.9(4)(a)
AC-05	Separation Of Duties	Art.9(4)(c)Art.9(4)(d)
AC-06	Least Privilege	Art.9(4)(c)Art.9(4)(d)
AC-07	Unsuccessful Login Attempts	Art.9(4)(c)
AC-08	System Use Notification	Art.9(4)(c)
AC-09	Previous Logon Notification	Art.10(1)
AC-10	Concurrent Session Control	Art.9(4)(c)
AC-11	Session Lock	Art.9(4)(c)
AC-12	Session Termination	Art.9(4)(c)
AC-14	Permitted Actions Without Identification Or Authentication	Art.9(4)(c)
AC-15	Automated Marking	Art.8(1)
AC-16	Automated Labeling	Art.8(1)Art.8(4)
AC-17	Remote Access	Art.9(4)(a)Art.9(4)(c)
AC-18	Wireless Access Restrictions	Art.9(4)(a)
AC-19	Access Control For Portable And Mobile Devices	Art.9(4)(a)Art.9(4)(c)
AC-20	Use Of External Information Systems	Art.28(1)(a)Art.28(5)

AT Awareness and Training

Control	Name	EU DORA References
AT-01	Security Awareness And Training Policy And Procedures	Art.13(6)Art.5(4)
AT-02	Security Awareness	Art.13(6)Art.5(4)
AT-03	Security Training	Art.13(6)Art.5(4)
AT-04	Security Training Records	Art.13(6)
AT-05	Contacts With Security Groups And Associations	Art.13(6)Art.45(1)
AT-06	Training Feedback	Art.13(6)Art.5(4)

AU Audit and Accountability

Control	Name	EU DORA References
AU-01	Audit And Accountability Policy And Procedures	Art.6(5)Art.6(8)
AU-02	Auditable Events	Art.10(1)Art.10(2)
AU-03	Content Of Audit Records	Art.10(1)
AU-04	Audit Storage Capacity	Art.10(1)
AU-05	Response To Audit Processing Failures	Art.10(1)Art.10(2)
AU-06	Audit Monitoring, Analysis, And Reporting	Art.10(1)Art.10(2)
AU-07	Audit Reduction And Report Generation	Art.10(1)
AU-08	Time Stamps	Art.10(1)
AU-09	Protection Of Audit Information	Art.10(1)
AU-10	Non-Repudiation	Art.10(1)
AU-11	Audit Record Retention	Art.10(1)Art.19(4)
AU-12	Audit Record Generation	Art.10(1)

CA Security Assessment and Authorization

Control	Name	EU DORA References
CA-01	Certification, Accreditation, And Security Assessment Policies And Procedures	Art.24(1)Art.5(1)Art.6(1)
CA-02	Security Assessments	Art.24(1)Art.24(2)Art.25(1)Art.6(4)
CA-03	Information System Connections	Art.9(4)(a)
CA-04	Security Certification	Art.24(1)Art.25(1)
CA-05	Plan Of Action And Milestones	Art.6(4)
CA-06	Security Accreditation	Art.5(2)Art.6(1)
CA-07	Continuous Monitoring	Art.10(1)Art.10(2)Art.24(1)Art.6(4)
CA-08	Penetration Testing	Art.24(1)Art.25(1)Art.26
CA-09	Internal System Connections	Art.6(4)

CM Configuration Management

Control	Name	EU DORA References
CM-01	Configuration Management Policy And Procedures	Art.7(1)Art.9(1)
CM-02	Baseline Configuration	Art.7(1)Art.9(1)
CM-03	Configuration Change Control	Art.9(4)(e)
CM-04	Monitoring Configuration Changes	Art.25(1)Art.9(4)(e)
CM-05	Access Restrictions For Change	Art.9(4)(c)Art.9(4)(e)
CM-06	Configuration Settings	Art.7(1)Art.9(1)
CM-07	Least Functionality	Art.7(1)Art.9(1)
CM-08	Information System Component Inventory	Art.28(4)Art.8(1)Art.8(4)
CM-12	Information Location	Art.28(4)Art.8(1)Art.8(4)
CM-13	Data Action Mapping	Art.8(1)
CM-14	Signed Components	Art.9(4)(e)

CP Contingency Planning

Control	Name	EU DORA References
CP-01	Contingency Planning Policy And Procedures	Art.11(1)Art.11(3)Art.12(1)
CP-02	Contingency Plan	Art.11(1)Art.11(3)Art.11(4)Art.12(1)
CP-03	Contingency Training	Art.11(6)Art.13(6)
CP-04	Contingency Plan Testing And Exercises	Art.11(6)Art.11(7)
CP-05	Contingency Plan Update	Art.11(6)
CP-06	Alternate Storage Site	Art.12(2)Art.12(5)
CP-07	Alternate Processing Site	Art.11(3)Art.12(2)Art.12(5)
CP-08	Telecommunications Services	Art.11(3)Art.12(2)
CP-09	Information System Backup	Art.12(1)Art.12(2)Art.12(3)Art.12(5)
CP-10	Information System Recovery And Reconstitution	Art.11(1)Art.11(2)Art.11(4)
CP-12	Safe Mode	Art.11(1)
CP-13	Alternative Security Mechanisms	Art.11(1)

IA Identification and Authentication

Control	Name	EU DORA References
IA-01	Identification And Authentication Policy And Procedures	Art.9(4)(c)Art.9(4)(d)
IA-02	User Identification And Authentication	Art.9(4)(c)Art.9(4)(d)
IA-03	Device Identification And Authentication	Art.9(4)(c)
IA-04	Identifier Management	Art.9(4)(c)Art.9(4)(d)
IA-05	Authenticator Management	Art.9(3)Art.9(4)(c)Art.9(4)(d)
IA-06	Authenticator Feedback	Art.9(4)(c)
IA-07	Cryptographic Module Authentication	Art.9(3)
IA-08	Identification and Authentication (Non-Organizational Users)	Art.9(4)(d)
IA-12	Identity Proofing	Art.9(4)(d)

IR Incident Response

Control	Name	EU DORA References
IR-01	Incident Response Policy And Procedures	Art.17(1)Art.17(2)Art.17(3)
IR-02	Incident Response Training	Art.13(6)Art.17(3)(d)
IR-03	Incident Response Testing And Exercises	Art.17(2)Art.24(1)
IR-04	Incident Handling	Art.17(1)Art.17(3)Art.18(1)Art.18(2)
IR-05	Incident Monitoring	Art.17(3)(c)Art.18(1)
IR-06	Incident Reporting	Art.11(7)Art.14Art.19(1)Art.19(4)Art.20(1)
IR-07	Incident Response Assistance	Art.11(7)Art.14Art.17(3)(d)Art.22(1)
IR-08	Incident Response Plan	Art.17(1)
IR-09	Information Spillage Response	Art.17(1)Art.17(2)Art.17(3)

MA Maintenance

Control	Name	EU DORA References
MA-01	System Maintenance Policy And Procedures	Art.7(1)Art.9(1)
MA-02	Controlled Maintenance	Art.7(1)
MA-03	Maintenance Tools	Art.7(1)Art.9(4)(e)
MA-04	Remote Maintenance	Art.9(4)(a)Art.9(4)(c)
MA-05	Maintenance Personnel	Art.28(5)
MA-06	Timely Maintenance	Art.7(1)
MA-07	Field Maintenance	Art.7(1)

MP Media Protection

Control	Name	EU DORA References
MP-01	Media Protection Policy And Procedures	Art.9(4)(a)Art.9(4)(b)
MP-02	Media Access	Art.9(4)(b)
MP-03	Media Labeling	Art.8(1)
MP-04	Media Storage	Art.9(4)(a)Art.9(4)(b)
MP-05	Media Transport	Art.9(4)(a)Art.9(4)(b)
MP-06	Media Sanitization And Disposal	Art.9(4)(b)
MP-08	Media Downgrading	Art.9(4)(b)

PE Physical and Environmental Protection

Control	Name	EU DORA References
PE-01	Physical And Environmental Protection Policy And Procedures	Art.9(1)
PE-02	Physical Access Authorizations	Art.9(1)
PE-03	Physical Access Control	Art.9(1)

PL Planning

Control	Name	EU DORA References
PL-01	Security Planning Policy And Procedures	Art.5(1)Art.6(1)
PL-02	System Security Plan	Art.6(1)Art.6(2)
PL-03	System Security Plan Update	Art.6(4)
PL-04	Rules Of Behavior	Art.5(4)
PL-05	Privacy Impact Assessment	Art.6(2)Art.6(5)
PL-06	Security-Related Activity Planning	Art.6(1)
PL-09	Central Management	Art.5(1)Art.5(2)Art.6(1)
PL-10	Baseline Selection	Art.24(2)Art.6(1)
PL-11	Baseline Tailoring	Art.24(2)Art.6(1)

PM Program Management

Control	Name	EU DORA References
PM-01	Information Security Program Plan	Art.5(1)
PM-02	Information Security Program Leadership Role	Art.5(1)
PM-15	Security and Privacy Groups and Associations	Art.45(1)
PM-16	Threat Awareness Program	Art.13(1)Art.45(1)

PS Personnel Security

Control	Name	EU DORA References
PS-01	Personnel Security Policy And Procedures	Art.5(4)
PS-02	Position Categorization	Art.5(4)
PS-03	Personnel Screening	Art.5(4)
PS-04	Personnel Termination	Art.9(4)(c)
PS-05	Personnel Transfer	Art.9(4)(c)
PS-06	Access Agreements	Art.5(4)
PS-07	Third-Party Personnel Security	Art.28(5)Art.30(2)(a)
PS-08	Personnel Sanctions	Art.5(4)
PS-09	Position Descriptions	Art.5(4)

PT Personally Identifiable Information Processing and Transparency

Control	Name	EU DORA References
PT-01	Policy and Procedures	Art.6(8)
PT-06	System of Records Notice	Art.6(2)

RA Risk Assessment

Control	Name	EU DORA References
RA-01	Risk Assessment Policy And Procedures	Art.6(1)Art.6(2)
RA-02	Security Categorization	Art.8(1)Art.8(4)
RA-03	Risk Assessment	Art.6(2)Art.6(5)
RA-04	Risk Assessment Update	Art.6(4)Art.6(5)
RA-05	Vulnerability Scanning	Art.13(1)Art.25(1)Art.9(3)
RA-06	Technical Surveillance Countermeasures Survey	Art.25(1)Art.26
RA-07	Risk Response	Art.6(1)Art.6(2)Art.6(5)
RA-09	Criticality Analysis	Art.11(2)Art.11(3)Art.29(1)Art.30(3)Art.6(2)Art.8(4)

SA System and Services Acquisition

Control	Name	EU DORA References
SA-01	System And Services Acquisition Policy And Procedures	Art.7(1)Art.9(1)
SA-02	Allocation Of Resources	Art.6(1)
SA-03	Life Cycle Support	Art.7(1)Art.8(5)
SA-04	Acquisitions	Art.28(1)(a)Art.30(2)Art.30(3)
SA-05	Information System Documentation	Art.8(1)Art.8(4)
SA-06	Software Usage Restrictions	Art.9(4)(e)
SA-07	User Installed Software	Art.9(4)(e)
SA-08	Security Engineering Principles	Art.7(1)Art.9(1)
SA-09	External Information System Services	Art.28(1)(a)Art.28(2)Art.28(5)Art.30(2)Art.30(3)
SA-10	Developer Configuration Management	Art.8(5)Art.9(4)(e)
SA-11	Developer Security Testing	Art.25(1)Art.25(2)Art.9(4)(e)
SA-20	Customized Development of Critical Components	Art.25(2)
SA-21	Developer Screening	Art.28(5)
SA-22	Unsupported System Components	Art.8(5)

SC System and Communications Protection

Control	Name	EU DORA References
SC-01	System And Communications Protection Policy And Procedures	Art.9(1)Art.9(4)(a)
SC-02	Application Partitioning	Art.9(4)(a)
SC-03	Security Function Isolation	Art.9(4)(a)
SC-04	Information Remnance	Art.9(4)(b)
SC-05	Denial Of Service Protection	Art.9(2)
SC-06	Resource Priority	Art.9(2)
SC-07	Boundary Protection	Art.9(4)(a)
SC-08	Transmission Integrity	Art.9(3)Art.9(4)(a)
SC-10	Network Disconnect	Art.9(4)(c)
SC-12	Cryptographic Key Establishment And Management	Art.9(3)
SC-13	Use Of Cryptography	Art.9(3)
SC-14	Public Access Protections	Art.9(2)
SC-15	Collaborative Computing	Art.9(4)(a)
SC-16	Transmission Of Security Parameters	Art.9(3)
SC-17	Public Key Infrastructure Certificates	Art.9(3)
SC-18	Mobile Code	Art.9(4)(e)
SC-20	Secure Name / Address Resolution Service (Authoritative Source)	Art.9(4)(a)
SC-21	Secure Name / Address Resolution Service (Recursive Or Caching Resolver)	Art.9(4)(a)
SC-22	Architecture And Provisioning For Name / Address Resolution Service	Art.9(4)(a)
SC-23	Session Authenticity	Art.9(3)
SC-24	Fail in Known State	Art.11(4)Art.12(2)Art.9(2)
SC-28	Protection of Information at Rest	Art.9(3)
SC-46	Cross Domain Policy Enforcement	Art.9(4)(a)
SC-47	Alternate Communications Paths	Art.9(4)(a)

SI System and Information Integrity

Control	Name	EU DORA References
SI-01	System And Information Integrity Policy And Procedures	Art.7(1)Art.9(1)
SI-02	Flaw Remediation	Art.7(2)Art.9(4)(e)
SI-03	Malicious Code Protection	Art.9(4)(b)
SI-04	Information System Monitoring Tools And Techniques	Art.10(1)Art.10(2)
SI-05	Security Alerts And Advisories	Art.10(1)Art.13(1)
SI-06	Security Functionality Verification	Art.10(1)Art.10(2)
SI-07	Software And Information Integrity	Art.9(4)(b)Art.9(4)(e)
SI-08	Spam Protection	Art.9(4)(b)
SI-10	Information Accuracy, Completeness, Validity, And Authenticity	Art.9(4)(e)
SI-11	Error Handling	Art.9(4)(e)
SI-12	Information Output Handling And Retention	Art.12(3)Art.8(1)
SI-13	Predictable Failure Prevention	Art.7(1)Art.9(2)
SI-16	Memory Protection	Art.10(1)
SI-20	Tainting	Art.10(1)
SI-21	Information Refresh	Art.13(1)

SR Supply Chain Risk Management

Control	Name	EU DORA References
SR-01	Policy and Procedures	Art.28(1)(a)Art.28(2)Art.28(4)
SR-02	Supply Chain Risk Management Plan	Art.28(4)Art.28(5)
SR-03	Supply Chain Controls and Processes	Art.28(2)Art.29(1)Art.30(2)
SR-04	Provenance	Art.28(5)Art.30(2)(a)
SR-05	Acquisition Strategies, Tools, and Methods	Art.28(5)Art.30(2)(a)
SR-06	Supplier Assessments and Reviews	Art.28(6)Art.30(3)
SR-07	Supply Chain Operations Security	Art.28(5)Art.30(2)(a)
SR-08	Notification Agreements	Art.19(1)Art.28(7)
SR-10	Inspection of Systems or Components	Art.28(6)
SR-11	Component Authenticity	Art.28(5)Art.30(2)(a)
SR-12	Component Disposal	Art.28(8)Art.30(2)(g)