← Frameworks / Solvency II / Control Mappings

Machine-readable: JSON API guide

Solvency II Directive (2009/138/EC) — ICT and Security Risk

EU prudential regulation for insurance and reinsurance undertakings. Pillar 2 governance and risk management requirements include ICT risk, operational resilience, outsourcing controls, and key function holder accountability. Supplemented by EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) covering information security policy, logical security, cryptography, operations security, security monitoring, business continuity, and third-party ICT risk management.

Controls: 171
Total Mappings: 347
Publisher: European Parliament and Council / EIOPA Version: 2009/138/EC (EIOPA GL 2020)
Solvency II → SP 800-53 SP 800-53 → Solvency II Coverage Analysis
AC (14) AT (3) AU (7) CA (5) CM (11) CP (11) IA (7) IR (9) MA (4) MP (5) PE (16) PL (5) PM (11) PS (6) PT (4) RA (6) SA (12) SC (16) SI (8) SR (11)

AC Access Control

Control Name Solvency II References
AC-01 Policy and Procedures
Art.41(1)Art.41(3)DR.258DR.266EIOPA-ICT-4.4
AC-02 Account Management
EIOPA-ICT-4.4
AC-03 Access Enforcement
DR.266-DataSecEIOPA-ICT-4.4
AC-04 Information Flow Enforcement
Art.49(3)DR.266-DataSecEIOPA-Cloud-GL9EIOPA-ICT-4.6
AC-05 Separation of Duties
EIOPA-ICT-4.4
AC-06 Least Privilege
EIOPA-ICT-4.4
AC-07 Unsuccessful Logon Attempts
EIOPA-ICT-4.4
AC-11 Device Lock
EIOPA-ICT-4.4
AC-12 Session Termination
EIOPA-ICT-4.4
AC-16 Security and Privacy Attributes
DR.266-DataSecEIOPA-ICT-4.3
AC-17 Remote Access
EIOPA-ICT-4.4EIOPA-ICT-4.6
AC-18 Wireless Access
EIOPA-ICT-4.6
AC-19 Access Control for Mobile Devices
EIOPA-ICT-4.6
AC-20 Use of External Systems
Art.49(1)DR.272EIOPA-Cloud-GL3

AT Awareness and Training

Control Name Solvency II References
AT-01 Policy and Procedures
Art.41(3)DR.258DR.266
AT-02 Literacy Training and Awareness
DR.266
AT-03 Role-based Training
DR.266

AU Audit and Accountability

Control Name Solvency II References
AU-01 Policy and Procedures
Art.41(3)Art.46
AU-02 Event Logging
Pillar3-Reporting
AU-03 Content of Audit Records
Pillar3-Reporting
AU-06 Audit Record Review, Analysis, and Reporting
Art.46EIOPA-ICT-4.9
AU-09 Protection of Audit Information
Pillar3-Reporting
AU-10 Non-repudiation
Pillar3-Reporting
AU-11 Audit Record Retention
Pillar3-Reporting

CA Security Assessment and Authorization

Control Name Solvency II References
CA-01 Policy and Procedures
Art.41(1)Art.41(3)DR.258DR.266
CA-02 Control Assessments
Art.45Art.46Art.47DR.266EIOPA-Cloud-GL7EIOPA-ICT-4.2
CA-03 Information Exchange
EIOPA-ICT-4.6
CA-05 Plan of Action and Milestones
Art.45Art.46Art.47
CA-07 Continuous Monitoring
Art.45Art.46Art.47EIOPA-ICT-4.2

CM Configuration Management

Control Name Solvency II References
CM-01 Policy and Procedures
Art.41(3)DR.266
CM-02 Baseline Configuration
DR.266EIOPA-ICT-4.8
CM-03 Configuration Change Control
EIOPA-ICT-4.8EIOPA-ICT-4.11
CM-04 Impact Analyses
EIOPA-ICT-4.8EIOPA-ICT-4.11
CM-05 Access Restrictions for Change
EIOPA-ICT-4.8EIOPA-ICT-4.11
CM-06 Configuration Settings
DR.266EIOPA-ICT-4.8
CM-07 Least Functionality
EIOPA-ICT-4.8
CM-08 System Component Inventory
DR.266-DataSecEIOPA-ICT-4.3
CM-12 Information Location
DR.266-DataSecEIOPA-Cloud-GL9EIOPA-ICT-4.3
CM-13 Data Action Mapping
EIOPA-ICT-4.3
CM-14 Signed Components
EIOPA-ICT-4.8EIOPA-ICT-4.11

CP Contingency Planning

Control Name Solvency II References
CP-01 Policy and Procedures
Art.41(3)DR.266DR.266-BCPEIOPA-ICT-4.10
CP-02 Contingency Plan
DR.266DR.266-BCPDR.274EIOPA-Cloud-GL11EIOPA-ICT-4.10
CP-03 Contingency Training
DR.266-BCPEIOPA-ICT-4.10
CP-04 Contingency Plan Testing
DR.266-BCPDR.274EIOPA-ICT-4.10
CP-06 Alternate Storage Site
DR.266-BCPEIOPA-ICT-4.10
CP-07 Alternate Processing Site
DR.266-BCPEIOPA-ICT-4.10
CP-08 Telecommunications Services
DR.266-BCPEIOPA-ICT-4.10
CP-09 System Backup
DR.266-BCPEIOPA-ICT-4.10
CP-10 System Recovery and Reconstitution
DR.266-BCPEIOPA-ICT-4.10
CP-12 Safe Mode
DR.266-BCPEIOPA-ICT-4.10
CP-13 Alternative Security Mechanisms
DR.266-BCPEIOPA-ICT-4.10

IA Identification and Authentication

Control Name Solvency II References
IA-01 Policy and Procedures
Art.41(3)DR.266EIOPA-ICT-4.4
IA-02 Identification and Authentication (Organizational Users)
EIOPA-ICT-4.4
IA-04 Identifier Management
EIOPA-ICT-4.4
IA-05 Authenticator Management
EIOPA-ICT-4.4
IA-07 Cryptographic Module Authentication
EIOPA-ICT-4.7
IA-08 Identification and Authentication (Non-organizational Users)
EIOPA-ICT-4.4
IA-12 Identity Proofing
EIOPA-ICT-4.4

IR Incident Response

Control Name Solvency II References
IR-01 Policy and Procedures
Art.41(3)DR.266EIOPA-ICT-4.9
IR-02 Incident Response Training
EIOPA-ICT-4.9
IR-03 Incident Response Testing
EIOPA-ICT-4.9
IR-04 Incident Handling
DR.266EIOPA-ICT-4.9
IR-05 Incident Monitoring
EIOPA-ICT-4.9
IR-06 Incident Reporting
EIOPA-ICT-4.9
IR-07 Incident Response Assistance
EIOPA-ICT-4.9
IR-08 Incident Response Plan
EIOPA-ICT-4.9
IR-09 Information Spillage Response
EIOPA-ICT-4.9

MA Maintenance

Control Name Solvency II References
MA-01 Policy and Procedures
Art.41(3)EIOPA-ICT-4.8
MA-02 Controlled Maintenance
EIOPA-ICT-4.8
MA-03 Maintenance Tools
EIOPA-ICT-4.8
MA-06 Timely Maintenance
EIOPA-ICT-4.8

MP Media Protection

Control Name Solvency II References
MP-01 Policy and Procedures
Art.41(3)DR.266-DataSec
MP-02 Media Access
DR.266-DataSec
MP-03 Media Marking
DR.266-DataSec
MP-04 Media Storage
DR.266-DataSec
MP-06 Media Sanitization
DR.266-DataSec

PE Physical and Environmental Protection

Control Name Solvency II References
PE-01 Policy and Procedures
Art.41(3)EIOPA-ICT-4.5
PE-02 Physical Access Authorizations
EIOPA-ICT-4.5
PE-03 Physical Access Control
EIOPA-ICT-4.5
PE-04 Access Control for Transmission
EIOPA-ICT-4.5
PE-05 Access Control for Output Devices
EIOPA-ICT-4.5
PE-06 Monitoring Physical Access
EIOPA-ICT-4.5
PE-08 Visitor Access Records
EIOPA-ICT-4.5
PE-09 Power Equipment and Cabling
EIOPA-ICT-4.5
PE-10 Emergency Shutoff
EIOPA-ICT-4.5
PE-11 Emergency Power
EIOPA-ICT-4.5
PE-12 Emergency Lighting
EIOPA-ICT-4.5
PE-13 Fire Protection
EIOPA-ICT-4.5
PE-14 Environmental Controls
EIOPA-ICT-4.5
PE-15 Water Damage Protection
EIOPA-ICT-4.5
PE-17 Alternate Work Site
EIOPA-ICT-4.5
PE-18 Location of System Components
EIOPA-ICT-4.5

PL Planning

Control Name Solvency II References
PL-01 Policy and Procedures
Art.41(1)Art.41(3)DR.258EIOPA-ICT-4.1
PL-02 System Security and Privacy Plans
EIOPA-ICT-4.1
PL-09 Central Management
Art.41(1)Art.44(1)DR.258EIOPA-ICT-4.1EIOPA-ICT-4.2
PL-10 Baseline Selection
Art.44(1)EIOPA-ICT-4.2
PL-11 Baseline Tailoring
Art.44(1)EIOPA-ICT-4.2

PM Program Management

Control Name Solvency II References
PM-01 Information Security Program Plan
Art.41(1)Art.44(1)DR.258DR.260DR.266EIOPA-ICT-4.1EIOPA-ICT-4.2
PM-02 Information Security Program Leadership Role
Art.41(1)DR.258DR.260EIOPA-ICT-4.1
PM-03 Information Security and Privacy Resources
EIOPA-ICT-4.1
PM-04 Plan of Action and Milestones Process
Art.46
PM-06 Measures of Performance
Art.46Art.47
PM-08 Critical Infrastructure Plan
Art.44(2)DR.266
PM-09 Risk Management Strategy
Art.44(2)Art.45DR.260DR.266DR.267EIOPA-ICT-4.2
PM-11 Mission and Business Process Definition
Art.44(2)DR.266
PM-14 Testing, Training, and Monitoring
Art.46Art.47
PM-28 Risk Framing
Art.44(1)Art.44(2)Art.45DR.260EIOPA-ICT-4.2
PM-29 Risk Management Program Leadership Roles
Art.41(1)Art.44(1)DR.258DR.260EIOPA-ICT-4.1

PS Personnel Security

Control Name Solvency II References
PS-01 Policy and Procedures
Art.41(3)Art.42DR.258
PS-02 Position Risk Designation
Art.42
PS-03 Personnel Screening
Art.42
PS-06 Access Agreements
Art.42
PS-07 External Personnel Security
Art.49(1)DR.272
PS-09 Position Descriptions
Art.42DR.258

PT Personally Identifiable Information Processing and Transparency

Control Name Solvency II References
PT-01 Policy and Procedures
Art.49(3)EIOPA-Cloud-GL9
PT-02 Authority to Process Personally Identifiable Information
Art.49(3)EIOPA-Cloud-GL9
PT-03 Personally Identifiable Information Processing Purposes
Art.49(3)
PT-04 Consent
Art.49(3)EIOPA-Cloud-GL9

RA Risk Assessment

Control Name Solvency II References
RA-01 Policy and Procedures
Art.41(3)Art.44(1)Art.44(2)DR.260DR.266EIOPA-ICT-4.2
RA-02 Security Categorization
Art.44(2)DR.266-DataSecEIOPA-ICT-4.3
RA-03 Risk Assessment
Art.44(1)Art.44(2)Art.45DR.260DR.266DR.267EIOPA-Cloud-GL3EIOPA-ICT-4.2
RA-05 Vulnerability Monitoring and Scanning
DR.266
RA-07 Risk Response
Art.44(1)Art.44(2)Art.45DR.260EIOPA-ICT-4.2
RA-09 Criticality Analysis
Art.44(1)Art.45Art.49(2)EIOPA-Cloud-GL3EIOPA-ICT-4.2EIOPA-ICT-4.3

SA System and Services Acquisition

Control Name Solvency II References
SA-01 Policy and Procedures
Art.41(3)DR.266
SA-02 Allocation of Resources
EIOPA-ICT-4.1
SA-03 System Development Life Cycle
EIOPA-ICT-4.11
SA-04 Acquisition Process
Art.49(1)Art.49(2)DR.272EIOPA-Cloud-GL3
SA-05 System Documentation
EIOPA-ICT-4.3
SA-08 Security and Privacy Engineering Principles
EIOPA-ICT-4.11
SA-09 External System Services
Art.49(1)Art.49(2)Art.49(3)DR.272DR.274EIOPA-Cloud-GL3EIOPA-Cloud-GL11
SA-10 Developer Configuration Management
EIOPA-ICT-4.11
SA-11 Developer Testing and Evaluation
EIOPA-ICT-4.11
SA-15 Development Process, Standards, and Tools
EIOPA-ICT-4.11
SA-17 Developer Security and Privacy Architecture and Design
EIOPA-ICT-4.11
SA-21 Developer Screening
Art.49(1)

SC System and Communications Protection

Control Name Solvency II References
SC-01 Policy and Procedures
Art.41(3)DR.266
SC-02 Separation of System and User Functionality
EIOPA-ICT-4.6
SC-03 Security Function Isolation
EIOPA-ICT-4.6
SC-05 Denial-of-service Protection
EIOPA-ICT-4.6
SC-07 Boundary Protection
EIOPA-ICT-4.6
SC-08 Transmission Confidentiality and Integrity
Art.49(3)DR.266-DataSecEIOPA-Cloud-GL9EIOPA-ICT-4.6EIOPA-ICT-4.7
SC-12 Cryptographic Key Establishment and Management
DR.266-DataSecEIOPA-ICT-4.7
SC-13 Cryptographic Protection
DR.266-DataSecEIOPA-ICT-4.7
SC-17 Public Key Infrastructure Certificates
EIOPA-ICT-4.7
SC-20 Secure Name/Address Resolution Service (Authoritative Source)
EIOPA-ICT-4.6
SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
EIOPA-ICT-4.6
SC-22 Architecture and Provisioning for Name/Address Resolution Service
EIOPA-ICT-4.6
SC-24 Fail in Known State
EIOPA-ICT-4.10
SC-28 Protection of Information at Rest
Art.49(3)DR.266-DataSecEIOPA-Cloud-GL9EIOPA-ICT-4.7
SC-46 Cross Domain Policy Enforcement
EIOPA-ICT-4.6
SC-47 Alternate Communications Paths
EIOPA-ICT-4.6

SI System and Information Integrity

Control Name Solvency II References
SI-01 Policy and Procedures
Art.41(3)DR.266
SI-02 Flaw Remediation
DR.266EIOPA-ICT-4.8
SI-04 System Monitoring
EIOPA-ICT-4.9
SI-05 Security Alerts, Advisories, and Directives
EIOPA-ICT-4.9
SI-07 Software, Firmware, and Information Integrity
EIOPA-ICT-4.8Pillar3-Reporting
SI-10 Information Input Validation
Pillar3-Reporting
SI-12 Information Management and Retention
Art.49(3)DR.266-DataSecEIOPA-Cloud-GL9Pillar3-Reporting
SI-13 Predictable Failure Prevention
EIOPA-ICT-4.8

SR Supply Chain Risk Management

Control Name Solvency II References
SR-01 Policy and Procedures
Art.41(3)Art.49(1)Art.49(2)DR.272DR.274EIOPA-Cloud-GL11
SR-02 Supply Chain Risk Management Plan
Art.49(1)Art.49(2)DR.272EIOPA-Cloud-GL3
SR-03 Supply Chain Controls and Processes
Art.49(1)Art.49(2)DR.272EIOPA-Cloud-GL3
SR-04 Provenance
DR.272EIOPA-Cloud-GL3
SR-05 Acquisition Strategies, Tools, and Methods
Art.49(1)DR.272EIOPA-Cloud-GL3
SR-06 Supplier Assessments and Reviews
Art.49(1)Art.49(2)DR.272EIOPA-Cloud-GL3EIOPA-Cloud-GL7
SR-07 Supply Chain Operations Security
DR.272
SR-08 Notification Agreements
DR.272
SR-10 Inspection of Systems or Components
Art.49(2)DR.272EIOPA-Cloud-GL7
SR-11 Component Authenticity
DR.272
SR-12 Component Disposal
DR.274EIOPA-Cloud-GL11