Comparison
HIPAA vs Essential Eight
HIPAA Security Rule · ASD Essential Eight · data 2026-10-27
Requirement-level comparison of HIPAA Security Rule and ASD Essential Eight, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 126 ASD Essential Eight requirements, 30 map to something in HIPAA, 96 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (96)
| Essential Eight | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Patch applications · 10 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| Patch operating systems · 13 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(1)(ii)(D)+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| Multi-factor authentication · 15 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 19 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | §164.308(a)(5)(ii)(B) | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | §164.308(a)(5)(ii)(B) | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | §164.308(a)(5)(ii)(B) | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | §164.308(a)(5)(ii)(B) | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | §164.308(a)(5)(ii)(B) | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | §164.308(a)(5)(ii)(B)§164.310(d)§164.310(d)(2)(iii)+2 | Only shares CSF PR.PS-05, PR.PS-01: related, not a mapping | |
| User application hardening · 19 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i)+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (30)
| Essential Eight | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Patch applications · 2 | ||||
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8)+2 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 2 | ||||
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Multi-factor authentication · 1 | ||||
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | §164.312(b) | Same topic: Logging & Audit (editorial pick) |
| Restrict administrative privileges · 1 | ||||
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | §164.312(b) | Same topic: Logging & Audit (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | §164.312(b) | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| User application hardening · 1 | ||||
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | §164.312(b) | Same topic: Logging & Audit (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D)+1 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | §164.308(a)(1)(ii)(D) | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | §164.308(a)(6)(ii) | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | §164.308(a)(6)(ii) | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | §164.308(a)(1)(ii)(D) | Same topic: SIEM / SOC (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | §164.312(b) | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | §164.308(a)(1)(ii)(D) | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | §164.308(a)(1)(ii)(D) | Same topic: Cont. Monitoring (editorial pick) |
Of 69 HIPAA Security Rule requirements, 14 map to something in Essential Eight, 44 are only loosely related, and 11 have no mapping in our data.
Covers the HIPAA Security Rule only (not the Privacy or Breach Notification Rules).
Likely new work: HIPAA requirements with no mapping to Essential Eight (11)
| HIPAA | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 6 | ||||
| §164.308(a)(1) | Security Management Process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.308(a)(2) | Assigned Security Responsibility | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.308(a)(5) | Security Awareness and Training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.310 Physical safeguards · 4 | ||||
| §164.310(a) | Facility Access Controls | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.310(c) | Workstation Security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.310(d)(2)(ii) | Required Media Re-use | No mapping in our data | — | No mapping to Essential Eight in our data. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (44)
| HIPAA | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 14 | ||||
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| §164.308(a)(3) | Workforce Security | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping | |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(4) | Information Access Management | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | ISM-0109ISM-1228ISM-1509+5 | Only shares CSF DE.AE-02, DE.AE-03, PR.PS-04: related, not a mapping | |
| §164.308(a)(7) | Contingency Plan | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF RC.RP-03: related, not a mapping | |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | ISM-1515ISM-1511ISM-1705+5 | Only shares CSF RC.RP-02, RC.RP-03, RC.RP-05: related, not a mapping | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF RC.RP-03: related, not a mapping | |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | ISM-1807ISM-1488 | Only shares CSF ID.AM-02, ID.AM-04, PR.DS-02: related, not a mapping | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | ISM-1807ISM-1488 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08, PR.DS-02: related, not a mapping | |
| §164.310 Physical safeguards · 5 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | ISM-1511ISM-1515ISM-1705+5 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.310(b) | Workstation Use | ISM-0109ISM-0445ISM-0843+5 | Only shares CSF DE.CM-09, PR.AA-05: related, not a mapping | |
| §164.310(d)(2)(i) | Required Disposal | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312 Technical safeguards · 11 | ||||
| §164.312(a) | Access Control | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| §164.312(a)(2)(i) | Required Unique User Identification | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | ISM-0109ISM-1906ISM-1907+5 | Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312(c) | Integrity | ISM-1488ISM-1511ISM-1515+5 | Only shares CSF DE.CM-09, PR.DS-02, PR.DS-11, RC.RP-03: related, not a mapping | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | ISM-1488ISM-0109ISM-0304+5 | Only shares CSF DE.CM-09, PR.DS-02, PR.PS-02: related, not a mapping | |
| §164.312(d) | Person or Entity Authentication | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| §164.312(e)(1) | Transmission Security | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | ISM-1488ISM-0109ISM-0304+5 | Only shares CSF DE.CM-09, PR.DS-02, PR.PS-02: related, not a mapping | |
| §164.312(e)(2)(ii) | Addressable Encryption | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.314 Organizational requirements · 9 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | ISM-1807 | Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping | |
| §164.314(a)(2)(i) | Required Business Associate Contracts | ISM-1819ISM-1807ISM-0123+1 | Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04…: related, not a mapping | |
| §164.314(a)(2)(ii) | Required Other Arrangements | ISM-1807ISM-1488 | Only shares CSF ID.AM-02, ID.AM-04, PR.DS-02: related, not a mapping | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | ISM-1819ISM-1807ISM-0123+1 | Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04…: related, not a mapping | |
| §164.314(b) | Requirements for Group Health Plans | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | ISM-1807 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | ISM-1819ISM-0123ISM-0140 | Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04…: related, not a mapping | |
| §164.316 Policies and documentation · 5 | ||||
| §164.316(a) | Policies and Procedures | ISM-1807ISM-0304ISM-1407+5 | Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping | |
| §164.316(b) | Documentation | ISM-1807ISM-0304ISM-1407+5 | Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping | |
| §164.316(b)(2)(i) | Required Time Limit | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(ii) | Required Availability | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| §164.316(b)(2)(iii) | Required Updates | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
Mapped (14)
| HIPAA | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 10 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Editorial | ISM-0109ISM-1228ISM-1906+1 | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| §164.308(a)(6) | Security Incident Procedures | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| §164.308(a)(6)(ii) | Required Response and Reporting | Editorial | ISM-0123ISM-0140ISM-1819 | Same topic: Reporting, Incident Response (editorial pick) |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| §164.308(a)(8) | Evaluation | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.310 Physical safeguards · 3 | ||||
| §164.310(d) | Device and Media Controls | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| §164.310(d)(2)(iii) | Addressable Accountability | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| §164.312 Technical safeguards · 1 | ||||
| §164.312(b) | Audit Controls | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
By topic
Both cover (10):
Asset ManagementVulnerability MgmtBackup & RecoveryEndpoint ProtectionCont. MonitoringLogging & AuditSIEM / SOCIncident ResponseReportingDisaster Recovery
Only HIPAA (17):
Governance PolicyAwareness & TrainingRisk ManagementRoles & ResponsibilitiesComplianceRisk AssessmentAccess ControlEncryptionData ProtectionMobile SecurityCloud SecurityMitigationRecovery PlanningBusiness ContinuityInsider ThreatVendor Risk MgmtPhysical Security
Only Essential Eight (6):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.