← Frameworks / ECB CROE / Control Mappings

Machine-readable: JSON API guide

ECB Cyber Resilience Oversight Expectations for Financial Market Infrastructures

European Central Bank expectations for cyber resilience of euro area financial market infrastructures. 21 expectations across 3 pillars: governance (board oversight, risk appetite, cyber strategy), identification and protection (threat-led testing, situational awareness, learning and evolving), and detection and response (incident management, recovery, crisis communication). Builds on CPMI-IOSCO cyber resilience guidance with ECB-specific supervisory expectations.

Controls: 181
Total Mappings: 269
Publisher: European Central Bank (ECB) Version: 2018
ECB CROE → SP 800-53 SP 800-53 → ECB CROE Coverage Analysis
AC (16) AT (5) AU (10) CA (7) CM (14) CP (11) IA (6) IR (9) MA (4) MP (6) PE (16) PL (4) PM (16) PS (9) PT (3) RA (8) SA (6) SC (17) SI (8) SR (6)

AC Access Control

Control Name ECB CROE References
AC-01 Policy and Procedures
CROE.2.3.1
AC-02 Account Management
CROE.2.3.1
AC-03 Access Enforcement
CROE.2.3.1
AC-04 Information Flow Enforcement
CROE.2.3.5
AC-05 Separation of Duties
CROE.2.3.1
AC-06 Least Privilege
CROE.2.3.1
AC-07 Unsuccessful Logon Attempts
CROE.2.3.1
AC-09 Previous Logon Notification
CROE.2.3.1
AC-10 Concurrent Session Control
CROE.2.3.1
AC-11 Device Lock
CROE.2.3.1
AC-12 Session Termination
CROE.2.3.1
AC-17 Remote Access
CROE.2.3.5
AC-18 Wireless Access
CROE.2.3.5
AC-19 Access Control for Mobile Devices
CROE.2.3.5
AC-20 Use of External Systems
CROE.2.2.3
AC-24 Access Control Decisions
CROE.2.3.1

AT Awareness and Training

Control Name ECB CROE References
AT-01 Policy and Procedures
CROE.2.1.2CROE.2.3.2
AT-02 Literacy Training and Awareness
CROE.2.1.2CROE.2.3.2CROE.2.8.2
AT-03 Role-based Training
CROE.2.1.2CROE.2.3.2CROE.2.8.2
AT-04 Training Records
CROE.2.3.2
AT-06 Training Feedback
CROE.2.1.2CROE.2.3.2CROE.2.8.1

AU Audit and Accountability

Control Name ECB CROE References
AU-02 Event Logging
CROE.2.4
AU-03 Content of Audit Records
CROE.2.4
AU-04 Audit Log Storage Capacity
CROE.2.4
AU-05 Response to Audit Logging Process Failures
CROE.2.4
AU-06 Audit Record Review, Analysis, and Reporting
CROE.2.4
AU-07 Audit Record Reduction and Report Generation
CROE.2.4
AU-09 Protection of Audit Information
CROE.2.4
AU-12 Audit Record Generation
CROE.2.4
AU-13 Monitoring for Information Disclosure
CROE.2.4CROE.2.7.1
AU-14 Session Audit
CROE.2.4

CA Security Assessment and Authorization

Control Name ECB CROE References
CA-02 Control Assessments
CROE.2.2.1CROE.2.6.1CROE.2.8.1
CA-03 Information Exchange
CROE.2.2.3CROE.2.3.5
CA-04 Security Certification
CROE.2.6.1
CA-05 Plan of Action and Milestones
CROE.2.8.1
CA-06 Authorization
CROE.2.2.1
CA-07 Continuous Monitoring
CROE.2.2.1CROE.2.4CROE.2.8.1
CA-08 Penetration Testing
CROE.2.6.1CROE.2.6.2

CM Configuration Management

Control Name ECB CROE References
CM-01 Policy and Procedures
CROE.2.3.4
CM-02 Baseline Configuration
CROE.2.3.4
CM-03 Configuration Change Control
CROE.2.3.4
CM-04 Impact Analyses
CROE.2.3.4
CM-05 Access Restrictions for Change
CROE.2.3.4
CM-06 Configuration Settings
CROE.2.3.4
CM-07 Least Functionality
CROE.2.3.4
CM-08 System Component Inventory
CROE.2.2.2
CM-09 Configuration Management Plan
CROE.2.3.4
CM-10 Software Usage Restrictions
CROE.2.3.4
CM-11 User-installed Software
CROE.2.3.4
CM-12 Information Location
CROE.2.2.2
CM-13 Data Action Mapping
CROE.2.2.2
CM-14 Signed Components
CROE.2.3.4

CP Contingency Planning

Control Name ECB CROE References
CP-01 Policy and Procedures
CROE.2.5.2
CP-02 Contingency Plan
CROE.2.5.2CROE.2.5.3
CP-03 Contingency Training
CROE.2.5.2
CP-04 Contingency Plan Testing
CROE.2.5.2CROE.2.6.1
CP-06 Alternate Storage Site
CROE.2.5.2
CP-07 Alternate Processing Site
CROE.2.5.2
CP-08 Telecommunications Services
CROE.2.5.2
CP-09 System Backup
CROE.2.5.2
CP-10 System Recovery and Reconstitution
CROE.2.5.2
CP-12 Safe Mode
CROE.2.5.2CROE.2.5.3
CP-13 Alternative Security Mechanisms
CROE.2.5.2

IA Identification and Authentication

Control Name ECB CROE References
IA-01 Policy and Procedures
CROE.2.3.1
IA-02 Identification and Authentication (Organizational Users)
CROE.2.3.1
IA-04 Identifier Management
CROE.2.3.1
IA-05 Authenticator Management
CROE.2.3.1
IA-08 Identification and Authentication (Non-organizational Users)
CROE.2.3.1
IA-12 Identity Proofing
CROE.2.3.1

IR Incident Response

Control Name ECB CROE References
IR-01 Policy and Procedures
CROE.2.5.1
IR-02 Incident Response Training
CROE.2.5.1
IR-03 Incident Response Testing
CROE.2.5.1CROE.2.6.1
IR-04 Incident Handling
CROE.2.4CROE.2.5.1CROE.2.8.1
IR-05 Incident Monitoring
CROE.2.5.1CROE.2.8.1
IR-06 Incident Reporting
CROE.2.5.1CROE.2.5.3CROE.2.7.2
IR-07 Incident Response Assistance
CROE.2.5.1CROE.2.5.3
IR-08 Incident Response Plan
CROE.2.5.1
IR-09 Information Spillage Response
CROE.2.5.1

MA Maintenance

Control Name ECB CROE References
MA-01 Policy and Procedures
CROE.2.3.4
MA-02 Controlled Maintenance
CROE.2.3.4
MA-04 Nonlocal Maintenance
CROE.2.3.4
MA-05 Maintenance Personnel
CROE.2.3.4

MP Media Protection

Control Name ECB CROE References
MP-01 Policy and Procedures
CROE.2.2.2CROE.2.3.3
MP-02 Media Access
CROE.2.2.2CROE.2.3.3
MP-03 Media Marking
CROE.2.3.3
MP-04 Media Storage
CROE.2.3.3
MP-05 Media Transport
CROE.2.3.3
MP-06 Media Sanitization
CROE.2.3.3

PE Physical and Environmental Protection

Control Name ECB CROE References
PE-01 Policy and Procedures
CROE.2.3.6
PE-02 Physical Access Authorizations
CROE.2.3.6
PE-03 Physical Access Control
CROE.2.3.6
PE-04 Access Control for Transmission
CROE.2.3.6
PE-05 Access Control for Output Devices
CROE.2.3.6
PE-06 Monitoring Physical Access
CROE.2.3.6
PE-08 Visitor Access Records
CROE.2.3.6
PE-09 Power Equipment and Cabling
CROE.2.3.6
PE-10 Emergency Shutoff
CROE.2.3.6
PE-11 Emergency Power
CROE.2.3.6CROE.2.5.2
PE-12 Emergency Lighting
CROE.2.3.6
PE-13 Fire Protection
CROE.2.3.6
PE-14 Environmental Controls
CROE.2.3.6
PE-15 Water Damage Protection
CROE.2.3.6
PE-17 Alternate Work Site
CROE.2.3.6CROE.2.5.2
PE-18 Location of System Components
CROE.2.3.6

PL Planning

Control Name ECB CROE References
PL-01 Policy and Procedures
CROE.2.1.1
PL-02 System Security and Privacy Plans
CROE.2.1.1
PL-04 Rules of Behavior
CROE.2.1.2CROE.2.3.2
PL-09 Central Management
CROE.2.1.1

PM Program Management

Control Name ECB CROE References
PM-01 Information Security Program Plan
CROE.2.1.1
PM-02 Information Security Program Leadership Role
CROE.2.1.1CROE.2.1.2
PM-03 Information Security and Privacy Resources
CROE.2.1.1
PM-04 Plan of Action and Milestones Process
CROE.2.2.1CROE.2.8.1
PM-05 System Inventory
CROE.2.2.1CROE.2.2.2
PM-08 Critical Infrastructure Plan
CROE.2.2.3CROE.2.5.2CROE.2.5.3
PM-09 Risk Management Strategy
CROE.2.1.1CROE.2.2.1
PM-11 Mission and Business Process Definition
CROE.2.2.2CROE.2.2.3
PM-12 Insider Threat Program
CROE.2.5.1CROE.2.7.2
PM-13 Security and Privacy Workforce
CROE.2.1.1CROE.2.1.2
PM-14 Testing, Training, and Monitoring
CROE.2.1.2CROE.2.4CROE.2.6.1CROE.2.8.1
PM-15 Security and Privacy Groups and Associations
CROE.2.2.3CROE.2.5.3CROE.2.7.1CROE.2.7.2CROE.2.8.2
PM-16 Threat Awareness Program
CROE.2.4CROE.2.6.2CROE.2.7.1CROE.2.7.2CROE.2.8.2
PM-28 Risk Framing
CROE.2.1.1CROE.2.2.1
PM-29 Risk Management Program Leadership Roles
CROE.2.1.1CROE.2.1.2
PM-31 Continuous Monitoring Strategy
CROE.2.8.1CROE.2.8.2

PS Personnel Security

Control Name ECB CROE References
PS-01 Policy and Procedures
CROE.2.1.2CROE.2.3.2
PS-02 Position Risk Designation
CROE.2.1.2CROE.2.3.2
PS-03 Personnel Screening
CROE.2.1.2CROE.2.3.2
PS-04 Personnel Termination
CROE.2.3.2
PS-05 Personnel Transfer
CROE.2.3.2
PS-06 Access Agreements
CROE.2.1.2CROE.2.3.2
PS-07 External Personnel Security
CROE.2.3.2
PS-08 Personnel Sanctions
CROE.2.3.2
PS-09 Position Descriptions
CROE.2.1.2

PT Personally Identifiable Information Processing and Transparency

Control Name ECB CROE References
PT-01 Policy and Procedures
CROE.2.3.3
PT-02 Authority to Process Personally Identifiable Information
CROE.2.3.3
PT-03 Personally Identifiable Information Processing Purposes
CROE.2.3.3

RA Risk Assessment

Control Name ECB CROE References
RA-01 Policy and Procedures
CROE.2.2.1
RA-02 Security Categorization
CROE.2.2.1CROE.2.2.2
RA-03 Risk Assessment
CROE.2.2.1CROE.2.7.1CROE.2.8.2
RA-05 Vulnerability Monitoring and Scanning
CROE.2.2.1CROE.2.4CROE.2.6.1CROE.2.6.2CROE.2.7.1
RA-06 Technical Surveillance Countermeasures Survey
CROE.2.6.1
RA-07 Risk Response
CROE.2.2.1CROE.2.8.1CROE.2.8.2
RA-09 Criticality Analysis
CROE.2.2.1CROE.2.2.2
RA-10 Threat Hunting
CROE.2.4CROE.2.6.2CROE.2.7.1

SA System and Services Acquisition

Control Name ECB CROE References
SA-04 Acquisition Process
CROE.2.2.3
SA-08 Security and Privacy Engineering Principles
CROE.2.3.4
SA-09 External System Services
CROE.2.2.2CROE.2.2.3
SA-11 Developer Testing and Evaluation
CROE.2.3.4CROE.2.6.1
SA-15 Development Process, Standards, and Tools
CROE.2.3.4CROE.2.6.1
SA-22 Unsupported System Components
CROE.2.3.4CROE.2.8.2

SC System and Communications Protection

Control Name ECB CROE References
SC-02 Separation of System and User Functionality
CROE.2.3.5
SC-03 Security Function Isolation
CROE.2.3.5
SC-04 Information in Shared System Resources
CROE.2.3.5
SC-05 Denial-of-service Protection
CROE.2.3.5CROE.2.4
SC-07 Boundary Protection
CROE.2.3.5CROE.2.4
SC-08 Transmission Confidentiality and Integrity
CROE.2.3.3CROE.2.3.5
SC-12 Cryptographic Key Establishment and Management
CROE.2.3.3
SC-13 Cryptographic Protection
CROE.2.3.3
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
CROE.2.3.5
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
CROE.2.3.5
SC-22 Architecture and Provisioning for Name/Address Resolution Service
CROE.2.3.5
SC-24 Fail in Known State
CROE.2.5.2
SC-26 Decoys
CROE.2.4CROE.2.6.2
SC-28 Protection of Information at Rest
CROE.2.2.2CROE.2.3.3
SC-36 Distributed Processing and Storage
CROE.2.5.2
SC-39 Process Isolation
CROE.2.3.5
SC-44 Detonation Chambers
CROE.2.3.5

SI System and Information Integrity

Control Name ECB CROE References
SI-02 Flaw Remediation
CROE.2.3.4CROE.2.8.1CROE.2.8.2
SI-03 Malicious Code Protection
CROE.2.3.4CROE.2.4
SI-04 System Monitoring
CROE.2.3.5CROE.2.4
SI-05 Security Alerts, Advisories, and Directives
CROE.2.4CROE.2.5.1CROE.2.5.3CROE.2.7.1CROE.2.7.2CROE.2.8.2
SI-06 Security and Privacy Function Verification
CROE.2.6.1
SI-07 Software, Firmware, and Information Integrity
CROE.2.3.3CROE.2.4
SI-12 Information Management and Retention
CROE.2.3.3
SI-16 Memory Protection
CROE.2.3.4

SR Supply Chain Risk Management

Control Name ECB CROE References
SR-01 Policy and Procedures
CROE.2.2.3
SR-02 Supply Chain Risk Management Plan
CROE.2.2.3
SR-03 Supply Chain Controls and Processes
CROE.2.2.3
SR-05 Acquisition Strategies, Tools, and Methods
CROE.2.2.3
SR-06 Supplier Assessments and Reviews
CROE.2.2.3CROE.2.7.1
SR-08 Notification Agreements
CROE.2.7.1