DORA control library
Every control CMDash tracks for DORA, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
Families
ICT Risk Management · 22
| Art.5 | Governance and organisation Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.6(1) | ICT risk management framework Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.6(2) | Framework documentation and review |
| Art.6(3) | Dedicated ICT risk management function |
| Art.7 | ICT systems, protocols and tools Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.8(1) | Identification of ICT risks Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.8(2) | Business function and ICT asset mapping |
| Art.8(3) | Risk assessment frequency |
| Art.9(1) | Protection and prevention Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.9(2) | ICT security policies |
| Art.9(3) | Network security management |
| Art.9(4) | Access control mechanisms Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.10(1) | Detection of anomalous activities Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.10(2) | Multiple layers of control |
| Art.11(1) | Response and recovery Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.11(2) | Business continuity policy Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.11(3) | ICT disaster recovery plan Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.11(4) | Backup policies and procedures Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.11(5) | Restoration and recovery from ICT incidents |
| Art.12 | Learning and evolving |
| Art.13(1) | Communication |
| Art.13(2) | Designated spokesperson |
Incident Management · 5
| Art.17(1) | ICT-related incident management process Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.17(2) | Early warning indicators |
| Art.17(3) | Incident classification |
| Art.18(1) | Classification of ICT-related incidents |
| Art.18(2) | Major incident criteria |
Incident Reporting · 5
| Art.19(1) | Reporting of major ICT-related incidents Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.19(2) | Initial notification to competent authority |
| Art.19(3) | Intermediate report |
| Art.19(4) | Final report submission |
| Art.20 | Harmonised reporting content and templates |
Resilience Testing · 7
| Art.24(1) | General requirements for digital operational resilience testing |
| Art.24(2) | Proportionality of testing |
| Art.25(1) | Testing of ICT tools and systems Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.25(2) | Source code review and scenario-based testing |
| Art.26(1) | Advanced TLPT testing |
| Art.26(2) | TLPT scope and methodology |
| Art.26(3) | TLPT frequency |
Third-Party Risk · 8
| Art.28(1) | General principles for ICT third-party risk management Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.28(2) | Register of ICT third-party providers |
| Art.28(3) | Proportionate monitoring of ICT TPSPs |
| Art.29(1) | Preliminary assessment of ICT concentration risk |
| Art.30(1) | Key contractual provisions |
| Art.30(2) | Service level descriptions |
| Art.30(3) | Exit strategies |
| Art.31 | Designation of critical ICT TPSPs |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for DORA 2022/2554, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from Regulation (EU) 2022/2554 (DORA), which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.