Comparison
HIPAA vs Cyber Essentials
HIPAA Security Rule · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of HIPAA Security Rule and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 4 map to something in HIPAA, 1 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| Cyber Essentials | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Technical controls · 1 | ||||
| CE 1 | Firewalls | §164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.310(b)+5 | Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping | |
Mapped (4)
| Cyber Essentials | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Technical controls · 4 | ||||
| CE 2 | Secure Configuration | Editorial | §164.310(d) | Same topic: Mobile Security (editorial pick) |
| CE 3 | Security Update Management | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8)+2 | Same topic: Vulnerability Mgmt (editorial pick) |
| CE 4 | User Access Control | Editorial | §164.308(a)(4)§164.308(b)(1)§164.312(a)+2 | Same topic: Access Control, Cloud Security (editorial pick) |
| CE 5 | Malware protection | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
Of 69 HIPAA Security Rule requirements, 11 map to something in Cyber Essentials, 29 are only loosely related, and 29 have no mapping in our data.
Covers the HIPAA Security Rule only (not the Privacy or Breach Notification Rules).
Likely new work: HIPAA requirements with no mapping to Cyber Essentials (29)
| HIPAA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 16 | ||||
| §164.308(a)(1) | Security Management Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(2) | Assigned Security Responsibility | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(5) | Security Awareness and Training | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(6) | Security Incident Procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(6)(ii) | Required Response and Reporting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7) | Contingency Plan | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310 Physical safeguards · 7 | ||||
| §164.310(a) | Facility Access Controls | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(a)(2)(i) | Addressable Contingency Operations | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(c) | Workstation Security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(d)(2)(i) | Required Disposal | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(d)(2)(ii) | Required Media Re-use | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.312 Technical safeguards · 4 | ||||
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.312(b) | Audit Controls | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.312(e)(1) | Transmission Security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.312(e)(2)(ii) | Addressable Encryption | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.314 Organizational requirements · 2 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (29)
| HIPAA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 8 | ||||
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | CE 3CE 5 | Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping | |
| §164.308(a)(3) | Workforce Security | CE 4CE 1CE 2 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | CE 4CE 1CE 2+1 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01, ID.AM-03: related, not a mapping | |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | CE 4CE 2 | Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | CE 1CE 2CE 4 | Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | CE 4CE 1CE 2+1 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01, ID.AM-03: related, not a mapping | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | CE 4CE 2 | Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | CE 3CE 1CE 4 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08, ID.AM-03: related, not a mapping | |
| §164.310 Physical safeguards · 3 | ||||
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | CE 1CE 3 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.310(b) | Workstation Use | CE 4CE 1CE 2+1 | Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01, ID.AM-03: related, not a mapping | |
| §164.312 Technical safeguards · 5 | ||||
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | CE 4CE 1CE 2 | Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | CE 4 | Only shares CSF PR.AA-03: related, not a mapping | |
| §164.312(c) | Integrity | CE 3CE 5 | Only shares CSF PR.PS-02, DE.CM-09: related, not a mapping | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | CE 3CE 5 | Only shares CSF PR.PS-02, DE.CM-09: related, not a mapping | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | CE 3CE 5 | Only shares CSF PR.PS-02, DE.CM-09: related, not a mapping | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | CE 3CE 4 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping | |
| §164.314(a)(2)(i) | Required Business Associate Contracts | CE 3CE 4 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping | |
| §164.314(a)(2)(ii) | Required Other Arrangements | CE 3CE 1CE 4 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-03: related, not a mapping | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | CE 3CE 4 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping | |
| §164.314(b) | Requirements for Group Health Plans | CE 1CE 3 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | CE 1CE 3 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | CE 1CE 3 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | CE 3CE 4 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| §164.316 Policies and documentation · 5 | ||||
| §164.316(a) | Policies and Procedures | CE 3CE 1 | Only shares CSF ID.AM-08, ID.RA-01, ID.AM-03: related, not a mapping | |
| §164.316(b) | Documentation | CE 3CE 1 | Only shares CSF ID.AM-08, ID.RA-01, ID.AM-03: related, not a mapping | |
| §164.316(b)(2)(i) | Required Time Limit | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(ii) | Required Availability | CE 4CE 2 | Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01: related, not a mapping | |
| §164.316(b)(2)(iii) | Required Updates | CE 4CE 2CE 1+1 | Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01, ID.AM-03: related, not a mapping | |
Mapped (11)
| HIPAA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 6 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(a)(4) | Information Access Management | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| §164.308(a)(8) | Evaluation | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| §164.310 Physical safeguards · 2 | ||||
| §164.310(d) | Device and Media Controls | Editorial | CE 2CE 3 | Same topic: Mobile Security, Asset Management (editorial pick) |
| §164.310(d)(2)(iii) | Addressable Accountability | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| §164.312 Technical safeguards · 3 | ||||
| §164.312(a) | Access Control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| §164.312(a)(2)(i) | Required Unique User Identification | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| §164.312(d) | Person or Entity Authentication | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
By topic
Both cover (6):
Only HIPAA (21):
Governance PolicyAwareness & TrainingRisk ManagementRoles & ResponsibilitiesComplianceRisk AssessmentEncryptionData ProtectionBackup & RecoveryCont. MonitoringLogging & AuditSIEM / SOCIncident ResponseMitigationReportingRecovery PlanningBusiness ContinuityDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only Cyber Essentials (5):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.