Vergleich
NIST CSF 2.0 vs. HIPAA Security Rule: CSF zur Erfüllung von HIPAA nutzen
NIST Cybersecurity Framework 2.0 · HIPAA Security Rule · Daten 2026-10-27
Die HIPAA Security Rule (45 CFR Part 164, Subpart C) verpflichtet Covered Entities und Business Associates, elektronisch geschützte Gesundheitsinformationen (ePHI) mit administrativen, physischen und technischen Schutzmaßnahmen zu sichern. Manche Implementierungsspezifikationen sind verpflichtend, andere sind adressierbar. Durchgesetzt wird die Regelung vom Office for Civil Rights, und im Mittelpunkt steht eine gründliche Risikoanalyse.
Die eigene Leitlinie des NIST, SP 800-66 Rev 2, verknüpft die Security Rule mit NIST-Kontrollen. ControlMapping nutzt das Crosswalk des NIST von HIPAA zu SP 800-53, um jede HIPAA-Anforderung mit CSF-Ergebnissen zu verknüpfen. Ausgehend von CSF zu HIPAA sind nahezu alle Standards und Spezifikationen der Security Rule zugeordnet oder lose verwandt: Ein CSF-orientiertes Programm leistet also den größten Teil dessen, was HIPAA verlangt.
Die übrigen HIPAA-Punkte sind spezifische Pflichten ohne klares CSF-Ergebnis, etwa Vertragsbestimmungen mit Business Associates und die Wiederverwendung von Datenträgern. Dabei handelt es sich eher um rechtliche und vertragliche Anforderungen als um technische Kontrollen.
Ausgehend von HIPAA zu CSF fordert CSF mehr als HIPAA, nämlich Governance-Ergebnisse wie Risikostrategie, Erwartungen der Stakeholder sowie Management von Lieferkettenrisiken, Identitätsprüfung, Threat Intelligence und sichere Softwareentwicklung. Das HHS hat im Januar 2025 umfassende Änderungen an der Security Rule vorgeschlagen. Prüfen Sie den aktuellen Stand der Regelung, bevor Sie sich auf die Unterscheidung zwischen verpflichtend und adressierbar verlassen.
Kernaussagen
- Beginnen Sie mit einer dokumentierten Risikoanalyse: Sie ist die HIPAA-Anforderung, auf die sich Auditoren und Untersuchungen des OCR am stärksten konzentrieren.
- CSF → HIPAA: Ergänzen Sie die rechtlichen Bestandteile (Business Associate Agreements, Richtlinien, Aufbewahrung der Dokumentation).
- HIPAA meint hier ausschließlich die Security Rule, nicht die Privacy Rule oder die Breach Notification Rule.
Diesen Vergleich herunterladen (CSV) In der Lückenanalyse öffnen →
Haben NIST CSF 2.0 → benötigen HIPAA
69 Anf. 38 zugeordnet · · 2 ohne Zuordnung In der Lückenansicht öffnen →Von 69 HIPAA Security Rule-Anforderungen sind 38 auf etwas in NIST CSF 2.0 zugeordnet, 29 sind nur lose verwandt und 2 haben keine Zuordnung in unseren Daten.
Deckt nur die HIPAA Security Rule ab (nicht die Privacy Rule oder die Breach Notification Rule).
Voraussichtlich neuer Aufwand: HIPAA-Anforderungen ohne Zuordnung zu NIST CSF 2.0 (2)
| HIPAA | Anforderung | Abgleich | NIST CSF 2.0 | Nachweis |
|---|---|---|---|---|
| §164.310 Physical safeguards · 1 | ||||
| §164.310(d)(2)(ii) | Required Media Re-use | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu NIST CSF 2.0 in unseren Daten. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu NIST CSF 2.0 in unseren Daten. |
Prüfen: nur lose verwandt (ein gemeinsames CSF-Ergebnis, keine Zuordnung) (29)
| HIPAA | Anforderung | Abgleich | NIST CSF 2.0 | Nachweis |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 11 | ||||
| §164.308(a)(1) | Security Management Process | GV.OC-03GV.OV-01GV.PO-01+2 | Teilt nur CSF GV.OC-03, GV.OV-01, GV.PO-01: verwandt, aber keine Zuordnung | |
| §164.308(a)(3) | Workforce Security | DE.CM-01DE.CM-03GV.OC-03+5 | Teilt nur CSF DE.CM-01, DE.CM-03, GV.OC-03: verwandt, aber keine Zuordnung | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | DE.CM-01DE.CM-03DE.CM-06+5 | Teilt nur CSF DE.CM-01, DE.CM-03, DE.CM-06: verwandt, aber keine Zuordnung | |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | GV.OC-03GV.OV-01GV.PO-01+3 | Teilt nur CSF GV.OC-03, GV.OV-01, GV.PO-01: verwandt, aber keine Zuordnung | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | ID.AM-03PR.AA-05PR.DS-01+2 | Teilt nur CSF ID.AM-03, PR.AA-05, PR.DS-01: verwandt, aber keine Zuordnung | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | DE.CM-01DE.CM-03DE.CM-06+5 | Teilt nur CSF DE.CM-01, DE.CM-03, DE.CM-06: verwandt, aber keine Zuordnung | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | DE.CM-01DE.CM-03GV.OC-03+5 | Teilt nur CSF DE.CM-01, DE.CM-03, GV.OC-03: verwandt, aber keine Zuordnung | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | DE.AE-02DE.AE-03PR.AT-01+2 | Teilt nur CSF DE.AE-02, DE.AE-03, PR.AT-01: verwandt, aber keine Zuordnung | |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | PR.AT-01PR.AT-02 | Teilt nur CSF PR.AT-01, PR.AT-02: verwandt, aber keine Zuordnung | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | GV.OC-04ID.AM-05ID.RA-04+4 | Teilt nur CSF GV.OC-04, ID.AM-05, ID.RA-04: verwandt, aber keine Zuordnung | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | DE.CM-06GV.OC-05GV.SC-04+5 | Teilt nur CSF DE.CM-06, GV.OC-05, GV.SC-04: verwandt, aber keine Zuordnung | |
| §164.310 Physical safeguards · 2 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | DE.CM-02GV.OC-04PR.AA-06+5 | Teilt nur CSF DE.CM-02, GV.OC-04, PR.AA-06: verwandt, aber keine Zuordnung | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | GV.OC-03GV.OV-01GV.PO-01+3 | Teilt nur CSF GV.OC-03, GV.OV-01, GV.PO-01: verwandt, aber keine Zuordnung | |
| §164.312 Technical safeguards · 5 | ||||
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | DE.CM-01DE.CM-03GV.OC-04+5 | Teilt nur CSF DE.CM-01, DE.CM-03, GV.OC-04: verwandt, aber keine Zuordnung | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | PR.AA-03 | Teilt nur CSF PR.AA-03: verwandt, aber keine Zuordnung | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | DE.CM-09ID.RA-09PR.DS-01+3 | Teilt nur CSF DE.CM-09, ID.RA-09, PR.DS-01: verwandt, aber keine Zuordnung | |
| §164.312(e)(1) | Transmission Security | PR.DS-02 | Teilt nur CSF PR.DS-02: verwandt, aber keine Zuordnung | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | DE.CM-09ID.RA-09PR.DS-01+3 | Teilt nur CSF DE.CM-09, ID.RA-09, PR.DS-01: verwandt, aber keine Zuordnung | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a)(2)(i) | Required Business Associate Contracts | DE.CM-06GV.OC-05GV.RR-04+5 | Teilt nur CSF DE.CM-06, GV.OC-05, GV.RR-04: verwandt, aber keine Zuordnung | |
| §164.314(a)(2)(ii) | Required Other Arrangements | DE.CM-06GV.OC-05GV.RR-04+5 | Teilt nur CSF DE.CM-06, GV.OC-05, GV.RR-04: verwandt, aber keine Zuordnung | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | DE.CM-06GV.OC-05GV.RR-04+5 | Teilt nur CSF DE.CM-06, GV.OC-05, GV.RR-04: verwandt, aber keine Zuordnung | |
| §164.314(b) | Requirements for Group Health Plans | ID.AM-03ID.AM-08 | Teilt nur CSF ID.AM-03, ID.AM-08: verwandt, aber keine Zuordnung | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | ID.AM-03ID.AM-08 | Teilt nur CSF ID.AM-03, ID.AM-08: verwandt, aber keine Zuordnung | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | ID.AM-03ID.AM-08 | Teilt nur CSF ID.AM-03, ID.AM-08: verwandt, aber keine Zuordnung | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | DE.CM-06GV.OC-05GV.SC-04+5 | Teilt nur CSF DE.CM-06, GV.OC-05, GV.SC-04: verwandt, aber keine Zuordnung | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | RC.CO-03RS.AN-06RS.AN-07+5 | Teilt nur CSF RC.CO-03, RS.AN-06, RS.AN-07: verwandt, aber keine Zuordnung | |
| §164.316 Policies and documentation · 3 | ||||
| §164.316(b) | Documentation | ID.AM-03ID.AM-08ID.RA-01 | Teilt nur CSF ID.AM-03, ID.AM-08, ID.RA-01: verwandt, aber keine Zuordnung | |
| §164.316(b)(2)(i) | Required Time Limit | ID.AM-07ID.AM-08 | Teilt nur CSF ID.AM-07, ID.AM-08: verwandt, aber keine Zuordnung | |
| §164.316(b)(2)(ii) | Required Availability | GV.OC-03GV.OV-01GV.PO-01+5 | Teilt nur CSF GV.OC-03, GV.OV-01, GV.PO-01: verwandt, aber keine Zuordnung | |
Zugeordnet (38)
| HIPAA | Anforderung | Abgleich | NIST CSF 2.0 | Nachweis |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 19 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Crosswalk | ID.RA-03ID.RA-04ID.RA-05+3 | Gleiches Thema: Risikobewertung |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Redaktionell | GV.RM-01GV.RM-02GV.RM-03+3 | Gleiches Thema: Risikomanagement (Redaktionelle Auswahl) |
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | Redaktionell | DE.CM-03GV.RR-04 | Gleiches Thema: Insider-Bedrohungen (Redaktionelle Auswahl) |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Crosswalk | DE.AE-03DE.AE-06DE.AE-08+3 | Gleiches Thema: SIEM / SOC |
| §164.308(a)(2) | Assigned Security Responsibility | Crosswalk | GV.RR-01GV.RR-02GV.RR-03 | Gleiches Thema: Rollen und Verantwortlichkeiten |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | Crosswalk | DE.CM-03GV.RR-04 | Gleiches Thema: Insider-Bedrohungen |
| §164.308(a)(4) | Information Access Management | Crosswalk | PR.AA-01PR.AA-05 | Gleiches Thema: Zugriffskontrolle |
| §164.308(a)(5) | Security Awareness and Training | Crosswalk | PR.AT-01PR.AT-02 | Gleiches Thema: Awareness & Training |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | Crosswalk | PR.AT-01PR.AT-02 | Gleiches Thema: Awareness & Training |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Redaktionell | DE.CM-09PR.PS-05 | Gleiches Thema: Endpoint-Schutz (Redaktionelle Auswahl) |
| §164.308(a)(6) | Security Incident Procedures | Crosswalk | ID.IM-04RS.MA-01RS.MA-02+2 | Gleiches Thema: Incident Response |
| §164.308(a)(6)(ii) | Required Response and Reporting | Crosswalk | ID.IM-04RS.CO-02RS.MA-01+5 | Gleiches Thema: Incident Response, Meldung |
| §164.308(a)(7) | Contingency Plan | Crosswalk | ID.IM-04RC.RP-01RC.RP-02 | Gleiches Thema: Wiederherstellungsplanung |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Crosswalk | PR.DS-11RC.RP-03 | Gleiches Thema: Backup & Recovery |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Crosswalk | ID.IM-04PR.IR-03RC.RP-01+2 | Gleiches Thema: Wiederherstellungsplanung, Disaster Recovery |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | Crosswalk | GV.OC-04PR.IR-03RC.RP-04 | Gleiches Thema: Business Continuity |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | Redaktionell | PR.IR-03RC.RP-02RC.RP-05 | Gleiches Thema: Disaster Recovery (Redaktionelle Auswahl) |
| §164.308(a)(8) | Evaluation | Crosswalk | ID.RA-01ID.RA-08GV.OC-03+1 | Gleiches Thema: Schwachstellenmanagement, Compliance |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+5 | Gleiches Thema: Lieferantenrisikomanagement |
| §164.310 Physical safeguards · 9 | ||||
| §164.310(a) | Facility Access Controls | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Gleiches Thema: Physische Sicherheit |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | Redaktionell | DE.CM-02PR.AA-06PR.IR-02 | Gleiches Thema: Physische Sicherheit (Redaktionelle Auswahl) |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Gleiches Thema: Physische Sicherheit |
| §164.310(b) | Workstation Use | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Gleiches Thema: Physische Sicherheit |
| §164.310(c) | Workstation Security | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Gleiches Thema: Physische Sicherheit |
| §164.310(d) | Device and Media Controls | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+3 | Gleiches Thema: Asset-Management |
| §164.310(d)(2)(i) | Required Disposal | Redaktionell | PR.DS-01PR.DS-02PR.DS-10 | Gleiches Thema: Datenschutz (Redaktionelle Auswahl) |
| §164.310(d)(2)(iii) | Addressable Accountability | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+1 | Gleiches Thema: Asset-Management |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Crosswalk | PR.DS-11RC.RP-03 | Gleiches Thema: Backup & Recovery |
| §164.312 Technical safeguards · 7 | ||||
| §164.312(a) | Access Control | Crosswalk | PR.AA-01PR.AA-05 | Gleiches Thema: Zugriffskontrolle |
| §164.312(a)(2)(i) | Required Unique User Identification | Crosswalk | PR.AA-01PR.AA-05 | Gleiches Thema: Zugriffskontrolle |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | Crosswalk | PR.DS-01PR.DS-02 | Gleiches Thema: Verschlüsselung |
| §164.312(b) | Audit Controls | Crosswalk | DE.AE-03PR.PS-04 | Gleiches Thema: Protokollierung & Audit |
| §164.312(c) | Integrity | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Gleiches Thema: Datenschutz |
| §164.312(d) | Person or Entity Authentication | Redaktionell | PR.AA-01PR.AA-05 | Gleiches Thema: Zugriffskontrolle (Redaktionelle Auswahl) |
| §164.312(e)(2)(ii) | Addressable Encryption | Crosswalk | PR.DS-01PR.DS-02 | Gleiches Thema: Verschlüsselung |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+2 | Gleiches Thema: Lieferantenrisikomanagement |
| §164.316 Policies and documentation · 2 | ||||
| §164.316(a) | Policies and Procedures | Crosswalk | GV.PO-01GV.PO-02 | Gleiches Thema: Governance-Richtlinie |
| §164.316(b)(2)(iii) | Required Updates | Crosswalk | GV.PO-01GV.PO-02 | Gleiches Thema: Governance-Richtlinie |
Haben HIPAA → benötigen NIST CSF 2.0
106 Anf. 63 zugeordnet · · 16 ohne Zuordnung In der Lückenansicht öffnen →Von 106 NIST Cybersecurity Framework 2.0-Anforderungen sind 63 auf etwas in HIPAA zugeordnet, 27 sind nur lose verwandt und 16 haben keine Zuordnung in unseren Daten.
Voraussichtlich neuer Aufwand: NIST CSF 2.0-Anforderungen ohne Zuordnung zu HIPAA (16)
| NIST CSF 2.0 | Anforderung | Abgleich | HIPAA | Nachweis |
|---|---|---|---|---|
| Detect (DE) · 1 | ||||
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| Govern (GV) · 7 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| Identify (ID) · 4 | ||||
| ID.IM-01 | Improvements are identified from evaluations | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| Protect (PR) · 4 | ||||
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Keine Zuordnung in unseren Daten | — | Keine Zuordnung zu HIPAA in unseren Daten. |
Prüfen: nur lose verwandt (ein gemeinsames CSF-Ergebnis, keine Zuordnung) (27)
| NIST CSF 2.0 | Anforderung | Abgleich | HIPAA | Nachweis |
|---|---|---|---|---|
| Detect (DE) · 2 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | §164.308(a)(1)(ii)(D)§164.308(a)(5)(ii)(C)§164.308(a)(6)+3 | Teilt nur CSF DE.AE-02: verwandt, aber keine Zuordnung | |
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Teilt nur CSF DE.AE-07: verwandt, aber keine Zuordnung | |
| Govern (GV) · 8 | ||||
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | §164.308(b)(1)§164.308(b)(4)§164.314(a)+4 | Teilt nur CSF GV.OC-05: verwandt, aber keine Zuordnung | |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | §164.308(a)(1)§164.308(a)(3)§164.308(a)(3)(ii)(A)+5 | Teilt nur CSF GV.OV-01: verwandt, aber keine Zuordnung | |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Teilt nur CSF GV.RM-07: verwandt, aber keine Zuordnung | |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | §164.308(a)(1)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)+5 | Teilt nur CSF GV.SC-03: verwandt, aber keine Zuordnung | |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | §164.308(b)(1)§164.308(b)(4)§164.314(a)+4 | Teilt nur CSF GV.SC-05: verwandt, aber keine Zuordnung | |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | §164.308(a)(6)§164.308(a)(7)§164.308(b)(1)+5 | Teilt nur CSF GV.SC-08: verwandt, aber keine Zuordnung | |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(b)(1)+5 | Teilt nur CSF GV.SC-09: verwandt, aber keine Zuordnung | |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(b)(1)+5 | Teilt nur CSF GV.SC-10: verwandt, aber keine Zuordnung | |
| Identify (ID) · 5 | ||||
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | §164.308(a)(1)(ii)(B)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(A)+5 | Teilt nur CSF ID.AM-03: verwandt, aber keine Zuordnung | |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(7)(ii)(E)+1 | Teilt nur CSF ID.AM-05: verwandt, aber keine Zuordnung | |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | §164.316(b)(2)(i) | Teilt nur CSF ID.AM-07: verwandt, aber keine Zuordnung | |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | §164.308(a)(1)(ii)(D)§164.308(a)(8) | Teilt nur CSF ID.RA-07: verwandt, aber keine Zuordnung | |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | §164.308(b)(4)§164.312(c)§164.312(c)(2)+4 | Teilt nur CSF ID.RA-09: verwandt, aber keine Zuordnung | |
| Protect (PR) · 3 | ||||
| PR.AA-03 | Users, services, and hardware are authenticated | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Teilt nur CSF PR.AA-03: verwandt, aber keine Zuordnung | |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i) | Teilt nur CSF PR.IR-04: verwandt, aber keine Zuordnung | |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | Teilt nur CSF PR.PS-02: verwandt, aber keine Zuordnung | |
| Recover (RC) · 3 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+3 | Teilt nur CSF RC.CO-03: verwandt, aber keine Zuordnung | |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)+5 | Teilt nur CSF RC.CO-04: verwandt, aber keine Zuordnung | |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | §164.308(a)(6)§164.308(a)(6)(ii) | Teilt nur CSF RC.RP-06: verwandt, aber keine Zuordnung | |
| Respond (RS) · 6 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+1 | Teilt nur CSF RS.AN-03: verwandt, aber keine Zuordnung | |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+4 | Teilt nur CSF RS.AN-06: verwandt, aber keine Zuordnung | |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+4 | Teilt nur CSF RS.AN-07: verwandt, aber keine Zuordnung | |
| RS.AN-08 | An incident's magnitude is estimated and validated | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(6)+2 | Teilt nur CSF RS.AN-08: verwandt, aber keine Zuordnung | |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+3 | Teilt nur CSF RS.CO-03: verwandt, aber keine Zuordnung | |
| RS.MA-05 | The criteria for initiating incident recovery are applied | §164.308(a)(6)§164.308(a)(6)(ii) | Teilt nur CSF RS.MA-05: verwandt, aber keine Zuordnung | |
Zugeordnet (63)
| NIST CSF 2.0 | Anforderung | Abgleich | HIPAA | Nachweis |
|---|---|---|---|---|
| Detect (DE) · 8 | ||||
| DE.AE-03 | Information is correlated from multiple sources | Crosswalk | §164.308(a)(1)(ii)(D)§164.312(b) | Gleiches Thema: SIEM / SOC, Protokollierung & Audit |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Crosswalk | §164.308(a)(1)(ii)(D) | Gleiches Thema: SIEM / SOC |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Crosswalk | §164.308(a)(1)(ii)(D) | Gleiches Thema: SIEM / SOC |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D) | Gleiches Thema: Kont. Überwachung |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Gleiches Thema: Physische Sicherheit |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D)§164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Gleiches Thema: Kont. Überwachung, Insider-Bedrohungen |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Crosswalk | §164.308(b)(1)§164.314(a) | Gleiches Thema: Lieferantenrisikomanagement |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D)§164.308(a)(5)(ii)(B) | Gleiches Thema: Kont. Überwachung, Endpoint-Schutz |
| Govern (GV) · 16 | ||||
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Redaktionell | §164.308(a)(8) | Gleiches Thema: Compliance (Redaktionelle Auswahl) |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Crosswalk | §164.308(a)(7)(ii)(C) | Gleiches Thema: Business Continuity |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Redaktionell | §164.308(a)(8) | Gleiches Thema: Compliance (Redaktionelle Auswahl) |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Crosswalk | §164.316(a)§164.316(b)(2)(iii) | Gleiches Thema: Governance-Richtlinie |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | §164.316(a)§164.316(b)(2)(iii) | Gleiches Thema: Governance-Richtlinie |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Redaktionell | §164.308(a)(1)(ii)(B) | Gleiches Thema: Risikomanagement (Redaktionelle Auswahl) |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Redaktionell | §164.308(a)(1)(ii)(B) | Gleiches Thema: Risikomanagement (Redaktionelle Auswahl) |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Redaktionell | §164.308(a)(1)(ii)(B) | Gleiches Thema: Risikomanagement (Redaktionelle Auswahl) |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Redaktionell | §164.308(a)(1)(ii)(B) | Gleiches Thema: Risikomanagement (Redaktionelle Auswahl) |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Crosswalk | §164.308(a)(2) | Gleiches Thema: Rollen und Verantwortlichkeiten |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Crosswalk | §164.308(a)(2) | Gleiches Thema: Rollen und Verantwortlichkeiten |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Crosswalk | §164.308(a)(2) | Gleiches Thema: Rollen und Verantwortlichkeiten |
| GV.RR-04 | Cybersecurity is included in human resources practices | Crosswalk | §164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Gleiches Thema: Insider-Bedrohungen |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Crosswalk | §164.308(b)(1)§164.314(a) | Gleiches Thema: Lieferantenrisikomanagement |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Crosswalk | §164.308(b)(1)§164.314(a) | Gleiches Thema: Lieferantenrisikomanagement |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Crosswalk | §164.308(b)(1)§164.314(a) | Gleiches Thema: Lieferantenrisikomanagement |
| Identify (ID) · 12 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Gleiches Thema: Asset-Management |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Gleiches Thema: Asset-Management |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Crosswalk | §164.308(b)(1)§164.310(d)§164.310(d)(2)(iii) | Gleiches Thema: Cloud-Sicherheit, Asset-Management |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Gleiches Thema: Asset-Management |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)+1 | Gleiches Thema: Incident Response, Wiederherstellungsplanung |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Gleiches Thema: Schwachstellenmanagement |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Crosswalk | §164.308(a)(1)(ii)(A) | Gleiches Thema: Risikobewertung |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Crosswalk | §164.308(a)(1)(ii)(A) | Gleiches Thema: Risikobewertung |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Crosswalk | §164.308(a)(1)(ii)(A) | Gleiches Thema: Risikobewertung |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Crosswalk | §164.308(a)(1)(ii)(A) | Gleiches Thema: Risikobewertung |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Gleiches Thema: Schwachstellenmanagement |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Crosswalk | §164.308(b)(1)§164.314(a) | Gleiches Thema: Lieferantenrisikomanagement |
| Protect (PR) · 15 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+1 | Gleiches Thema: Zugriffskontrolle |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+2 | Gleiches Thema: Zugriffskontrolle |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Gleiches Thema: Physische Sicherheit |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Gleiches Thema: Awareness & Training |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Gleiches Thema: Awareness & Training |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Crosswalk | §164.312(a)(2)(iv)§164.312(c)§164.312(e)(2)(ii)+1 | Gleiches Thema: Verschlüsselung, Datenschutz |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Crosswalk | §164.312(a)(2)(iv)§164.312(c)§164.312(e)(2)(ii)+1 | Gleiches Thema: Verschlüsselung, Datenschutz |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Crosswalk | §164.312(c)§164.310(d)(2)(i) | Gleiches Thema: Datenschutz |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Crosswalk | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Gleiches Thema: Backup & Recovery |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | Crosswalk | §164.308(b)(1) | Gleiches Thema: Cloud-Sicherheit |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Gleiches Thema: Physische Sicherheit |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Crosswalk | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D) | Gleiches Thema: Disaster Recovery, Business Continuity |
| PR.PS-01 | Configuration management practices are established and applied | Crosswalk | §164.308(b)(1)§164.310(d) | Gleiches Thema: Cloud-Sicherheit, Mobile Security |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Crosswalk | §164.312(b) | Gleiches Thema: Protokollierung & Audit |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | Redaktionell | §164.308(a)(5)(ii)(B) | Gleiches Thema: Endpoint-Schutz (Redaktionelle Auswahl) |
| Recover (RC) · 5 | ||||
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | Crosswalk | §164.308(a)(7)§164.308(a)(7)(ii)(B) | Gleiches Thema: Wiederherstellungsplanung |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Crosswalk | §164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D) | Gleiches Thema: Wiederherstellungsplanung, Disaster Recovery |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Crosswalk | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Gleiches Thema: Backup & Recovery |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Crosswalk | §164.308(a)(7)(ii)(C) | Gleiches Thema: Business Continuity |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Crosswalk | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D) | Gleiches Thema: Disaster Recovery |
| Respond (RS) · 7 | ||||
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Crosswalk | §164.308(a)(6)(ii) | Gleiches Thema: Meldung |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Gleiches Thema: Incident Response |
| RS.MA-02 | Incident reports are triaged and validated | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Gleiches Thema: Incident Response |
| RS.MA-03 | Incidents are categorized and prioritized | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Gleiches Thema: Incident Response |
| RS.MA-04 | Incidents are escalated or elevated as needed | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Gleiches Thema: Incident Response |
| RS.MI-01 | Incidents are contained | Crosswalk | §164.308(a)(6)(ii) | Gleiches Thema: Mitigation |
| RS.MI-02 | Incidents are eradicated | Crosswalk | §164.308(a)(6)(ii) | Gleiches Thema: Mitigation |
Nach Thema
Beide abgedeckt (27):
Governance-RichtlinieAwareness & TrainingRisikomanagementRollen und VerantwortlichkeitenComplianceAsset-ManagementRisikobewertungSchwachstellenmanagementZugriffskontrolleVerschlüsselungDatenschutzBackup & RecoveryEndpoint-SchutzMobile SecurityCloud-SicherheitKont. ÜberwachungProtokollierung & AuditSIEM / SOCIncident ResponseMitigationMeldungWiederherstellungsplanungBusiness ContinuityDisaster RecoveryInsider-BedrohungenLieferantenrisikomanagementPhysische Sicherheit
Nur NIST CSF 2.0 (23):
LieferkettenrisikoGeschäftsumfeldDatenklassifizierungThreat IntelligenceMulti-Faktor-AuthentifizierungPrivilegierter ZugriffFirewall / NetzsegmentierungPatch-ManagementSichere KonfigurationSichere EntwicklungE-Mail-SicherheitWebanwendungssicherheitZero TrustDNS-SicherheitWAFDLPAngriffserkennungAnomalieerkennungForensikKommunikationErkenntnisse aus VorfällenKommunikation & WiederherstellungAPI-Sicherheit
Anforderungs-IDs und Titel werden so angezeigt, wie jedes Framework sie veröffentlicht, auf Englisch.
Crosswalk eine veröffentlichte Crosswalk (NIST, ENISA, CIS, PCI SSC) stellt die Verbindung her · Redaktionell Einschätzung von ControlMapping, wo kein Crosswalk existiert; die Begründung wird angezeigt · teilt nur ein CSF-2.0-Ergebnis: einer Prüfung wert, aber keine Zuordnung · Keine Zuordnung in unseren Daten In unseren Daten nichts zugeordnet; oft neue Arbeit, aber prüfen Sie die Hinweise zur Abdeckung. Zugeordnet = gemeinsam in einem ControlMapping-Thema kuratiert oder direkt verknüpft. Crosswalks belegen keine Konformität. Methodik · Daten herunterladen · Fehler melden.