EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04): every control, and what you already have

43 controls 14 frameworks share controls with it European Union (EBA) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
DORA	9	measure it →
NIST Cybersecurity Framework 2.0	4	measure it →
ISO 27018:2019	2	measure it →
ISO 27002:2022	2	measure it →
ISO/IEC 38500:2024	1	measure it →
ISO 13485:2016	1	measure it →
ISO/IEC 17025:2017	1	measure it →
ISO/IEC 42001:2023	1	measure it →
ISO 19011:2018	1	measure it →
ISO 27001:2022	1	measure it →
ISO 27017:2015	1	measure it →
ISO 27701:2019	1	measure it →

Every control

Code	Control	Also in
`EBA-GL-3.1`	Proportionality	0
`EBA-GL-3.2`	Governance and strategy	0
`EBA-GL-3.2.1`	Governance	2
`EBA-GL-3.2.2`	Strategy	0
`EBA-GL-3.2.3`	Use of third party providers	1
`EBA-GL-3.3`	ICT and security risk management framework	0
`EBA-GL-3.3.1`	Organisation and objectives	1
`EBA-GL-3.3.2`	Identification of functions, processes and assets	2
`EBA-GL-3.3.3`	Classification and risk assessment	1
`EBA-GL-3.3.4`	Risk mitigation	0
`EBA-GL-3.3.5`	Reporting	4
`EBA-GL-3.3.6`	Audit	1
`EBA-GL-3.4`	Information security	0
`EBA-GL-3.4.1`	Information security policy	0
`EBA-GL-3.4.2`	Logical security	1
`EBA-GL-3.4.3`	Physical security	2
`EBA-GL-3.4.4`	ICT operations security	0
`EBA-GL-3.4.5`	Security monitoring	2
`EBA-GL-3.4.6`	Information security reviews, assessment and testing	3
`EBA-GL-3.4.7`	Information security training and awareness	1
`EBA-GL-3.5`	ICT operations management	0
`EBA-GL-3.5.1`	ICT incident and problem management	2
`EBA-GL-3.6`	ICT project and change management	0
`EBA-GL-3.6.1`	ICT project management	0
`EBA-GL-3.6.2`	ICT systems acquisition and development	0
`EBA-GL-3.6.3`	ICT change management	0
`EBA-GL-3.7`	Business continuity management	0
`EBA-GL-3.7.1`	Business impact analysis	2
`EBA-GL-3.7.2`	Business continuity planning	0
`EBA-GL-3.7.3`	Response and recovery plans	2
`EBA-GL-3.7.4`	Testing of plans	0
`EBA-GL-3.7.5`	Crisis communications	0
`EBA-GL-3.8`	Payment service user relationship management	0
`EBA-GL-92`	Awareness of security risks through assistance and guidance	0
`EBA-GL-93`	Updating guidance for new threats	0
`EBA-GL-94`	Option to disable payment functionalities	0
`EBA-GL-95`	Adjustable spending limits	0
`EBA-GL-96`	Alerts on initiated and failed payment transactions	0
`EBA-GL-97`	Informing users of updates to security procedures	0
`EBA-GL-98`	Assistance on security questions and anomaly notifications	0
`EBA-GL-ADDRESSEES`	Addressees (as amended)	0
`EBA-GL-STATUS`	Status and history	0
`EBA-GL-SUBJECT`	Subject matter and scope (as amended)	0

Tell me when EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition