Framework overlap

Does EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) cover EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)?

You hold EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) and have been told to do EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600). Here is how much overlaps, control by control.

68% of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) you already have

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) already covers about 68% of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600), leaving 8 of 25 controls as genuinely new work.

Already covered 0 Likely covered 17 New work 8

No control in EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) maps directly to one in EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600). Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) reaches these. This is the list to scope.

EIOPA-ICTSG-GL.1
Proportionality
EIOPA-ICTSG-GL.14
ICT operations management
EIOPA-ICTSG-GL.16
ICT project management
EIOPA-ICTSG-GL.17
ICT systems acquisition and development
EIOPA-ICTSG-GL.18
ICT change management
EIOPA-ICTSG-GL.23
Testing of plans
EIOPA-ICTSG-GL.24
Crisis communications
EIOPA-ICTSG-GL.7
Information security function
Show the 17 you already have
EIOPA-ICTSG-GL.10
ICT operations security
EIOPA-ICTSG-GL.11
Security monitoring
EIOPA-ICTSG-GL.12
Information security reviews, assessment and testing
EIOPA-ICTSG-GL.13
Information security training and awareness
EIOPA-ICTSG-GL.15
ICT incident and problem management
EIOPA-ICTSG-GL.19
Business continuity management
EIOPA-ICTSG-GL.2
ICT within the system of governance
EIOPA-ICTSG-GL.20
Business impact analysis
EIOPA-ICTSG-GL.21
Business continuity planning
EIOPA-ICTSG-GL.22
Response and recovery plans
EIOPA-ICTSG-GL.25
Outsourcing of ICT services and ICT systems
EIOPA-ICTSG-GL.3
ICT strategy
EIOPA-ICTSG-GL.4
ICT and security risks within the risk management system
EIOPA-ICTSG-GL.5
Audit
EIOPA-ICTSG-GL.6
Information security policy and measures
EIOPA-ICTSG-GL.8
Logical security
EIOPA-ICTSG-GL.9
Physical security

How this is calculated

Already covered means a mapping runs from a control in EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition