← Frameworks / DNB Good Practice / Control Mappings

Machine-readable: JSON API guide

DNB Good Practice Information Security 2023

De Nederlandsche Bank's mandatory information security framework for Dutch financial institutions including banks, insurers, pension funds, and payment institutions. 58 controls across 7 elements (governance, organisation, people, processes, technology, facilities, testing) with COBIT 4.1 maturity model assessment. DORA supersedes for in-scope entities from January 2025, but continues for pension funds. Self-assessment tool available.

Controls: 155
Total Mappings: 306
Publisher: De Nederlandsche Bank (DNB) Version: 2023
DNB Good Practice → SP 800-53 SP 800-53 → DNB Good Practice Coverage Analysis
AC (10) AT (5) AU (5) CA (6) CM (8) CP (9) IA (7) IR (7) MA (6) MP (5) PE (12) PL (4) PM (17) PS (7) RA (6) SA (11) SC (17) SI (8) SR (5)

AC Access Control

Control Name DNB Good Practice References
AC-01 Policy and Procedures
DNB.1.2
AC-02 Account Management
DNB.8.5DNB.17.2
AC-03 Access Enforcement
DNB.12.3DNB.17.2DNB.20.1
AC-04 Information Flow Enforcement
DNB.12.3DNB.18.4DNB.18.5
AC-05 Separation of Duties
DNB.7.1DNB.17.2
AC-06 Least Privilege
DNB.7.1DNB.17.2
AC-07 Unsuccessful Logon Attempts
DNB.17.2
AC-16 Security and Privacy Attributes
DNB.2.2DNB.6.1DNB.12.3
AC-17 Remote Access
DNB.18.4
AC-21 Information Sharing
DNB.18.5

AT Awareness and Training

Control Name DNB Good Practice References
AT-01 Policy and Procedures
DNB.1.2
AT-02 Literacy Training and Awareness
DNB.8.2DNB.9.1DNB.9.3
AT-03 Role-based Training
DNB.8.2DNB.9.2
AT-04 Training Records
DNB.9.2
AT-06 Training Feedback
DNB.9.1DNB.9.3

AU Audit and Accountability

Control Name DNB Good Practice References
AU-01 Policy and Procedures
DNB.1.2
AU-04 Audit Log Storage Capacity
DNB.18.1
AU-06 Audit Record Review, Analysis, and Reporting
DNB.16.1
AU-09 Protection of Audit Information
DNB.20.1
AU-11 Audit Record Retention
DNB.12.1

CA Security Assessment and Authorization

Control Name DNB Good Practice References
CA-01 Policy and Procedures
DNB.1.2
CA-02 Control Assessments
DNB.10.4DNB.16.1DNB.16.2DNB.16.3DNB.16.4DNB.16.5DNB.22.1
CA-05 Plan of Action and Milestones
DNB.4.3DNB.16.2
CA-06 Authorization
DNB.16.4DNB.16.5
CA-07 Continuous Monitoring
DNB.14.1DNB.16.1DNB.16.2
CA-08 Penetration Testing
DNB.16.1DNB.16.5DNB.22.1

CM Configuration Management

Control Name DNB Good Practice References
CM-01 Policy and Procedures
DNB.1.2DNB.10.1DNB.13.1
CM-02 Baseline Configuration
DNB.3.2DNB.10.3DNB.10.5DNB.13.1DNB.13.2
CM-03 Configuration Change Control
DNB.10.1DNB.10.2DNB.10.5DNB.13.2
CM-04 Impact Analyses
DNB.10.1DNB.10.2DNB.10.3DNB.10.4
CM-05 Access Restrictions for Change
DNB.7.1DNB.10.1DNB.10.5
CM-06 Configuration Settings
DNB.3.2DNB.13.1DNB.19.2DNB.20.1
CM-07 Least Functionality
DNB.3.2DNB.13.2DNB.20.1
CM-08 System Component Inventory
DNB.6.1DNB.13.1DNB.13.2DNB.19.3

CP Contingency Planning

Control Name DNB Good Practice References
CP-01 Policy and Procedures
DNB.1.2DNB.11.1
CP-02 Contingency Plan
DNB.8.3DNB.11.1DNB.11.4
CP-03 Contingency Training
DNB.11.2
CP-04 Contingency Plan Testing
DNB.11.2
CP-06 Alternate Storage Site
DNB.11.3
CP-07 Alternate Processing Site
DNB.11.1DNB.18.1
CP-08 Telecommunications Services
DNB.11.1DNB.18.1
CP-09 System Backup
DNB.11.3DNB.11.4
CP-10 System Recovery and Reconstitution
DNB.11.1DNB.11.4

IA Identification and Authentication

Control Name DNB Good Practice References
IA-01 Policy and Procedures
DNB.1.2DNB.17.1
IA-02 Identification and Authentication (Organizational Users)
DNB.17.1
IA-04 Identifier Management
DNB.17.1DNB.17.2
IA-05 Authenticator Management
DNB.17.1DNB.17.2
IA-07 Cryptographic Module Authentication
DNB.18.3
IA-08 Identification and Authentication (Non-organizational Users)
DNB.17.1
IA-12 Identity Proofing
DNB.17.1

IR Incident Response

Control Name DNB Good Practice References
IR-01 Policy and Procedures
DNB.1.2DNB.15.1DNB.15.2
IR-02 Incident Response Training
DNB.15.1
IR-03 Incident Response Testing
DNB.11.2
IR-04 Incident Handling
DNB.15.2
IR-05 Incident Monitoring
DNB.15.2
IR-06 Incident Reporting
DNB.15.2
IR-08 Incident Response Plan
DNB.15.1

MA Maintenance

Control Name DNB Good Practice References
MA-01 Policy and Procedures
DNB.1.2DNB.18.2
MA-02 Controlled Maintenance
DNB.18.2
MA-03 Maintenance Tools
DNB.18.2
MA-04 Nonlocal Maintenance
DNB.18.2
MA-05 Maintenance Personnel
DNB.18.2
MA-06 Timely Maintenance
DNB.18.2

MP Media Protection

Control Name DNB Good Practice References
MP-01 Policy and Procedures
DNB.1.2DNB.12.2
MP-02 Media Access
DNB.12.1
MP-04 Media Storage
DNB.2.2DNB.11.3DNB.12.1DNB.12.3
MP-06 Media Sanitization
DNB.12.2
MP-08 Media Downgrading
DNB.12.2

PE Physical and Environmental Protection

Control Name DNB Good Practice References
PE-01 Policy and Procedures
DNB.1.2DNB.21.1
PE-02 Physical Access Authorizations
DNB.8.5DNB.21.1DNB.21.2
PE-03 Physical Access Control
DNB.21.1DNB.21.2
PE-04 Access Control for Transmission
DNB.21.1
PE-05 Access Control for Output Devices
DNB.21.1
PE-06 Monitoring Physical Access
DNB.21.1DNB.21.2
PE-07 Visitor Control
DNB.21.2
PE-08 Visitor Access Records
DNB.21.1DNB.21.2
PE-09 Power Equipment and Cabling
DNB.18.1DNB.21.1
PE-10 Emergency Shutoff
DNB.18.1
PE-11 Emergency Power
DNB.18.1
PE-17 Alternate Work Site
DNB.11.3

PL Planning

Control Name DNB Good Practice References
PL-01 Policy and Procedures
DNB.1.1DNB.1.2DNB.5.1DNB.5.2
PL-02 System Security and Privacy Plans
DNB.1.1DNB.6.1DNB.19.3
PL-04 Rules of Behavior
DNB.9.1
PL-08 Security and Privacy Architectures
DNB.2.1DNB.3.2

PM Program Management

Control Name DNB Good Practice References
PM-01 Information Security Program Plan
DNB.1.1DNB.5.1DNB.5.2DNB.16.4
PM-02 Information Security Program Leadership Role
DNB.5.1DNB.5.2
PM-03 Information Security and Privacy Resources
DNB.4.3DNB.5.2
PM-04 Plan of Action and Milestones Process
DNB.4.3
PM-05 System Inventory
DNB.5.2DNB.6.1DNB.19.3
PM-06 Measures of Performance
DNB.5.2DNB.14.1DNB.16.2DNB.16.4
PM-07 Enterprise Architecture
DNB.2.1
PM-08 Critical Infrastructure Plan
DNB.4.1DNB.11.1
PM-09 Risk Management Strategy
DNB.1.1DNB.4.1DNB.4.2DNB.4.3
PM-11 Mission and Business Process Definition
DNB.1.1DNB.4.1DNB.11.1
PM-12 Insider Threat Program
DNB.8.1DNB.8.2DNB.8.3DNB.9.3DNB.15.2
PM-13 Security and Privacy Workforce
DNB.8.2DNB.8.3DNB.9.2
PM-14 Testing, Training, and Monitoring
DNB.5.2DNB.8.2DNB.9.2DNB.9.3DNB.11.2DNB.16.2DNB.16.5
PM-15 Security and Privacy Groups and Associations
DNB.3.1DNB.16.4
PM-16 Threat Awareness Program
DNB.3.1
PM-28 Risk Framing
DNB.4.1DNB.4.2
PM-29 Risk Management Program Leadership Roles
DNB.5.1

PS Personnel Security

Control Name DNB Good Practice References
PS-01 Policy and Procedures
DNB.1.2DNB.5.1DNB.8.1DNB.8.4
PS-02 Position Risk Designation
DNB.7.1DNB.8.1DNB.8.3
PS-03 Personnel Screening
DNB.8.1DNB.8.4
PS-04 Personnel Termination
DNB.8.5
PS-05 Personnel Transfer
DNB.8.5
PS-06 Access Agreements
DNB.8.4
PS-07 External Personnel Security
DNB.5.1DNB.8.4DNB.16.3

RA Risk Assessment

Control Name DNB Good Practice References
RA-01 Policy and Procedures
DNB.1.1DNB.1.2DNB.4.1
RA-02 Security Categorization
DNB.2.2DNB.4.1DNB.6.1
RA-03 Risk Assessment
DNB.3.1DNB.4.1DNB.4.2DNB.10.2
RA-05 Vulnerability Monitoring and Scanning
DNB.4.2DNB.16.1DNB.19.2DNB.22.1
RA-07 Risk Response
DNB.4.2DNB.4.3DNB.10.2DNB.19.2
RA-09 Criticality Analysis
DNB.4.2

SA System and Services Acquisition

Control Name DNB Good Practice References
SA-01 Policy and Procedures
DNB.1.2
SA-02 Allocation of Resources
DNB.1.1
SA-03 System Development Life Cycle
DNB.19.3
SA-04 Acquisition Process
DNB.3.2DNB.14.1DNB.14.2
SA-08 Security and Privacy Engineering Principles
DNB.2.1DNB.3.2
SA-09 External System Services
DNB.14.1DNB.14.2DNB.16.3
SA-10 Developer Configuration Management
DNB.10.1DNB.10.5
SA-11 Developer Testing and Evaluation
DNB.10.3DNB.10.4DNB.22.1
SA-15 Development Process, Standards, and Tools
DNB.10.4
SA-17 Developer Security and Privacy Architecture and Design
DNB.2.1
SA-22 Unsupported System Components
DNB.19.3

SC System and Communications Protection

Control Name DNB Good Practice References
SC-01 Policy and Procedures
DNB.1.2
SC-05 Denial-of-service Protection
DNB.18.1
SC-07 Boundary Protection
DNB.18.1DNB.18.4DNB.20.1
SC-08 Transmission Confidentiality and Integrity
DNB.12.3DNB.18.4DNB.18.5
SC-12 Cryptographic Key Establishment and Management
DNB.18.3DNB.18.5
SC-13 Cryptographic Protection
DNB.18.3DNB.18.5
SC-16 Transmission of Security and Privacy Attributes
DNB.2.2DNB.18.5
SC-17 Public Key Infrastructure Certificates
DNB.18.3
SC-18 Mobile Code
DNB.19.1
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
DNB.18.4
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
DNB.18.4
SC-22 Architecture and Provisioning for Name/Address Resolution Service
DNB.18.4
SC-23 Session Authenticity
DNB.18.4
SC-28 Protection of Information at Rest
DNB.12.3
SC-32 System Partitioning
DNB.10.3
SC-42 Sensor Capability and Data
DNB.20.1
SC-44 Detonation Chambers
DNB.19.1

SI System and Information Integrity

Control Name DNB Good Practice References
SI-01 Policy and Procedures
DNB.1.2
SI-02 Flaw Remediation
DNB.19.2
SI-03 Malicious Code Protection
DNB.19.1
SI-04 System Monitoring
DNB.16.1DNB.19.1
SI-05 Security Alerts, Advisories, and Directives
DNB.3.1DNB.15.1DNB.19.2
SI-08 Spam Protection
DNB.19.1
SI-12 Information Management and Retention
DNB.12.1DNB.12.2DNB.12.3
SI-13 Predictable Failure Prevention
DNB.11.4

SR Supply Chain Risk Management

Control Name DNB Good Practice References
SR-01 Policy and Procedures
DNB.1.2DNB.14.2
SR-02 Supply Chain Risk Management Plan
DNB.14.2
SR-03 Supply Chain Controls and Processes
DNB.14.2DNB.16.3
SR-05 Acquisition Strategies, Tools, and Methods
DNB.14.2
SR-06 Supplier Assessments and Reviews
DNB.14.2DNB.16.3