Comparison
HIPAA vs NIS2
HIPAA Security Rule · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Requirement-level comparison of HIPAA Security Rule and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 34 map to something in HIPAA, 13 are only loosely related, and 2 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to HIPAA (2)
| NIS2 | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| 11. Access control · 1 | ||||
| 11.3 | Privileged accounts and system administration accounts | No mapping in our data | — | No mapping to HIPAA in our data. |
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to HIPAA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (13)
| NIS2 | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| 3. Incident handling · 1 | ||||
| 3.6 | Post-incident reviews | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(6)+2 | Only shares CSF RS.AN-08: related, not a mapping | |
| 6. Security in acquisition, development and maintenance · 6 | ||||
| 6.2 | Secure development life cycle | §164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)+5 | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.3 | Configuration management | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| 6.4 | Change management, repairs and maintenance | §164.308(a)(1)(ii)(D)§164.308(a)(8) | Only shares CSF ID.RA-07: related, not a mapping | |
| 6.6 | Security patch management | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i)+5 | Only shares CSF DE.CM-09, PR.PS-02: related, not a mapping | |
| 6.7 | Network security | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)+5 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 6.8 | Network segmentation | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)+4 | Only shares CSF PR.IR-01: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | §164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)§164.308(a)(3)(ii)(C)+5 | Only shares CSF GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | §164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)§164.308(a)(3)(ii)(C)+5 | Only shares CSF GV.RR-04: related, not a mapping | |
| 11. Access control · 3 | ||||
| 11.4 | Administration systems | §164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 11.6 | Authentication | §164.310(b)§164.312(a)(2)(i)§164.312(d)+5 | Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping | |
| 11.7 | Multi-factor authentication | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Only shares CSF PR.AA-03: related, not a mapping | |
| 12. Asset management · 1 | ||||
| 12.1 | Asset classification | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(7)(ii)(E)+1 | Only shares CSF ID.AM-05: related, not a mapping | |
Mapped (34)
| NIS2 | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Crosswalk | §164.316(a)§164.316(b)(2)(iii) | Same topic: Governance Policy |
| 1.2 | Roles, responsibilities and authorities | Crosswalk | §164.308(a)(2) | Same topic: Roles & Responsibilities |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Same topic: Risk Assessment, Risk Management |
| 2.2 | Compliance monitoring | Editorial | §164.308(a)(8) | Same topic: Compliance (editorial pick) |
| 2.3 | Independent review of information and network security | Editorial | §164.308(a)(8) | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 5 | ||||
| 3.1 | Incident handling policy | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | §164.308(a)(1)(ii)(D)§164.312(b) | Same topic: Cont. Monitoring, SIEM / SOC, Logging & Audit |
| 3.3 | Event reporting | Crosswalk | §164.308(a)(6)(ii) | Same topic: Reporting |
| 3.4 | Event assessment and classification | Crosswalk | §164.308(a)(1)(ii)(D) | Same topic: SIEM / SOC |
| 3.5 | Incident response | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response, Mitigation |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Crosswalk | §164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)+1 | Same topic: Recovery Planning, Disaster Recovery, Business Continuity |
| 4.2 | Backup management | Crosswalk | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(d)(2)(iv)+1 | Same topic: Backup & Recovery, Disaster Recovery |
| 4.3 | Crisis management | Crosswalk | §164.308(a)(7)(ii)(C) | Same topic: Business Continuity |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | §164.308(b)(1)§164.314(a) | Same topic: Vendor Risk Mgmt |
| 5.2 | Directory of suppliers and service providers | Crosswalk | §164.308(b)(1)§164.314(a) | Same topic: Vendor Risk Mgmt |
| 6. Security in acquisition, development and maintenance · 4 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | §164.308(b)(1)§164.314(a) | Same topic: Cloud Security, Vendor Risk Mgmt |
| 6.5 | Security testing | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Same topic: Vulnerability Mgmt |
| 6.9 | Protection against malicious and unauthorised software | Editorial | §164.308(a)(5)(ii)(B) | Same topic: Endpoint Protection (editorial pick) |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Same topic: Vulnerability Mgmt |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Editorial | §164.308(a)(1)(ii)(B) | Same topic: Risk Management (editorial pick) |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | §164.312(a)(2)(iv)§164.312(e)(2)(ii) | Same topic: Encryption |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Crosswalk | §164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Same topic: Insider Threat |
| 10.4 | Disciplinary process | Crosswalk | §164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Same topic: Insider Threat |
| 11. Access control · 3 | ||||
| 11.1 | Access control policy | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+1 | Same topic: Access Control |
| 11.2 | Management of access rights | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+1 | Same topic: Access Control |
| 11.5 | Identification | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+1 | Same topic: Access Control |
| 12. Asset management · 3 | ||||
| 12.2 | Handling of assets | Crosswalk | §164.312(c)§164.310(d)(2)(i) | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | §164.312(c)§164.310(d)(2)(i) | Same topic: Data Protection |
| 12.4 | Asset inventory | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Same topic: Asset Management |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Same topic: Physical Security |
| 13.2 | Protection against physical and environmental threats | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Same topic: Physical Security |
| 13.3 | Perimeter and physical access control | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Same topic: Physical Security |
Of 69 HIPAA Security Rule requirements, 38 map to something in NIS2, 29 are only loosely related, and 2 have no mapping in our data.
Covers the HIPAA Security Rule only (not the Privacy or Breach Notification Rules).
Likely new work: HIPAA requirements with no mapping to NIS2 (2)
| HIPAA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| §164.310 Physical safeguards · 1 | ||||
| §164.310(d)(2)(ii) | Required Media Re-use | No mapping in our data | — | No mapping to NIS2 in our data. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (29)
| HIPAA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 11 | ||||
| §164.308(a)(1) | Security Management Process | 1.15.16.1+2 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(3) | Workforce Security | 1.16.711.5+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, DE.CM-01…: related, not a mapping | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | 1.14.36.7+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, DE.CM-01…: related, not a mapping | |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | 1.15.16.1+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | 9.14.311.1+5 | Only shares CSF PR.DS-01, PR.DS-02, ID.AM-03, PR.AA-05: related, not a mapping | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | 1.14.36.7+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, DE.CM-01…: related, not a mapping | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | 1.111.54.3+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AA-01…: related, not a mapping | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | 4.38.11.1+3 | Only shares CSF DE.AE-02, DE.AE-03, PR.AT-01, PR.AT-02: related, not a mapping | |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | 8.11.11.2+2 | Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | 2.16.103.5+3 | Only shares CSF ID.RA-04, ID.RA-05, RC.CO-04: related, not a mapping | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | 5.112.45.2+5 | Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.310 Physical safeguards · 2 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | 13.33.54.1+4 | Only shares CSF DE.CM-02, PR.AA-06, RC.CO-04, GV.OC-04: related, not a mapping | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | 1.15.16.1+4 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.312 Technical safeguards · 5 | ||||
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | 6.711.53.5+5 | Only shares CSF DE.CM-01, PR.IR-01, PR.AA-01, PR.AA-05…: related, not a mapping | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | 11.611.7 | Only shares CSF PR.AA-03: related, not a mapping | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | 6.69.16.1+3 | Only shares CSF DE.CM-09, PR.PS-02, PR.DS-01, PR.DS-02…: related, not a mapping | |
| §164.312(e)(1) | Transmission Security | 9.1 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | 6.69.16.1+3 | Only shares CSF DE.CM-09, PR.PS-02, PR.DS-01, PR.DS-02…: related, not a mapping | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a)(2)(i) | Required Business Associate Contracts | 3.55.13.4+5 | Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| §164.314(a)(2)(ii) | Required Other Arrangements | 5.112.45.2+5 | Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | 3.55.13.4+5 | Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| §164.314(b) | Requirements for Group Health Plans | 12.44.36.2 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | 12.44.36.2 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | 12.44.36.2 | Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | 5.15.212.4+4 | Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | 3.53.43.2+3 | Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| §164.316 Policies and documentation · 3 | ||||
| §164.316(b) | Documentation | 12.42.14.3+3 | Only shares CSF ID.AM-03, ID.AM-08, ID.RA-01: related, not a mapping | |
| §164.316(b)(2)(i) | Required Time Limit | 12.46.2 | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(ii) | Required Availability | 1.111.53.1+5 | Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AA-01…: related, not a mapping | |
Mapped (38)
| HIPAA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 19 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Crosswalk | 2.16.56.10 | Same topic: Risk Assessment, Vulnerability Mgmt |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | 2.16.56.10+1 | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | Editorial | 10.210.4 | Same topic: Insider Threat (editorial pick) |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Crosswalk | 3.23.4 | Same topic: Cont. Monitoring, SIEM / SOC |
| §164.308(a)(2) | Assigned Security Responsibility | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | Crosswalk | 10.210.4 | Same topic: Insider Threat |
| §164.308(a)(4) | Information Access Management | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| §164.308(a)(5) | Security Awareness and Training | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| §164.308(a)(6) | Security Incident Procedures | Crosswalk | 3.13.5 | Same topic: Incident Response |
| §164.308(a)(6)(ii) | Required Response and Reporting | Crosswalk | 3.13.33.5 | Same topic: Incident Response, Reporting, Mitigation |
| §164.308(a)(7) | Contingency Plan | Crosswalk | 4.1 | Same topic: Recovery Planning |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Crosswalk | 4.14.2 | Same topic: Recovery Planning, Disaster Recovery |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | Crosswalk | 4.14.3 | Same topic: Business Continuity |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | Editorial | 4.14.2 | Same topic: Disaster Recovery (editorial pick) |
| §164.308(a)(8) | Evaluation | Crosswalk | 6.56.102.2+1 | Same topic: Vulnerability Mgmt, Compliance |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt, Cloud Security |
| §164.310 Physical safeguards · 9 | ||||
| §164.310(a) | Facility Access Controls | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | Editorial | 13.113.213.3 | Same topic: Physical Security (editorial pick) |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| §164.310(b) | Workstation Use | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| §164.310(c) | Workstation Security | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| §164.310(d) | Device and Media Controls | Crosswalk | 12.4 | Same topic: Asset Management |
| §164.310(d)(2)(i) | Required Disposal | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| §164.310(d)(2)(iii) | Addressable Accountability | Crosswalk | 12.4 | Same topic: Asset Management |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| §164.312 Technical safeguards · 7 | ||||
| §164.312(a) | Access Control | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| §164.312(a)(2)(i) | Required Unique User Identification | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | Crosswalk | 9.1 | Same topic: Encryption |
| §164.312(b) | Audit Controls | Crosswalk | 3.2 | Same topic: Logging & Audit |
| §164.312(c) | Integrity | Crosswalk | 12.212.3 | Same topic: Data Protection |
| §164.312(d) | Person or Entity Authentication | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| §164.312(e)(2)(ii) | Addressable Encryption | Crosswalk | 9.1 | Same topic: Encryption |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| §164.316 Policies and documentation · 2 | ||||
| §164.316(a) | Policies and Procedures | Crosswalk | 1.1 | Same topic: Governance Policy |
| §164.316(b)(2)(iii) | Required Updates | Crosswalk | 1.1 | Same topic: Governance Policy |
By topic
Both cover (26):
Governance PolicyAwareness & TrainingRisk ManagementRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentVulnerability MgmtAccess ControlEncryptionData ProtectionBackup & RecoveryEndpoint ProtectionCloud SecurityCont. MonitoringLogging & AuditSIEM / SOCIncident ResponseMitigationReportingRecovery PlanningBusiness ContinuityDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only HIPAA (1):
Only NIS2 (17):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.