DORA – Control Mapping
This page shows which Wombat controls cover which requirements of DORA.
| Framework Control | Requirement | Wombat Controls | Severity | Pillar | Category |
|---|---|---|---|---|---|
Art. 6 – ICT risk management framework |
Art. 6 – ICT risk management framework |
🟡 |
Security |
identity-access |
|
Art. 9 – Protection and prevention |
Art. 9 – Protection and prevention |
WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-030 · WAF-SEC-050 · WAF-SEC-060 · WAF-SEC-070 · WAF-SEC-120 · WAF-SEC-130 · WAF-SEC-140 · WAF-SEC-150 |
🔴 🟠 🟡 |
Security |
container-security, identity-access, network-security |
Art. 9 – Protection and prevention of ICT incidents |
Art. 9 – Protection and prevention of ICT incidents |
🟠 |
Security |
identity-access |
|
Art. 10 – Detection of ICT-related incidents |
Art. 10 – Detection of ICT-related incidents |
🟠 |
Security |
identity-access |
|
Art. 12 – ICT-related incident management |
Art. 12 – ICT-related incident management |
🟠 |
Reliability |
backup-recovery |
|
Art. 12 – ICT-related incident reporting |
Art. 12 – ICT-related incident reporting |
🟠 |
Security |
logging-monitoring |
|
Art. 13 – ICT incident reporting |
Art. 13 – ICT incident reporting |
🟠 🟡 |
Security |
identity-access |
|
Art. 17 – ICT-related testing |
Art. 17 – ICT-related testing |
🟡 |
Security |
container-security |
|
Art. 17 – Testing of ICT tools and systems |
Art. 17 – Testing of ICT tools and systems |
🟡 |
Security |
identity-access |
|
Art. 28 – ICT third-party risk management |
Art. 28 – ICT third-party risk management |
🟠 |
Security, Sovereign Cloud |
container-security, identity-access |
|
Art. 28 – Subcontracting of ICT services |
Art. 28 – Subcontracting of ICT services |
🟠 |
Sovereign Cloud |
data-governance |
|
Art. 30 – Contractual arrangements |
Art. 30 – Contractual arrangements |
🟠 |
Security |
container-security |