Risk Analysis

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusRequired csf 2.0DE.AE-07 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-09 GV.SC-10 ID.AM-05 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-08 RS.AN-08 topicsRisk Assessment, Vulnerability Mgmt frameworks6 7 0

Official textConduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the covered entity or business associate.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(1)(ii)(A) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 ID.RA-01 ID.RA-08	Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt 8 loosely related (not mappings) DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Loosely related Only shares CSF DE.AE-07: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Loosely related Only shares CSF GV.RM-06: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Loosely related Only shares CSF ID.AM-05: related, not a mapping RS.AN-08 An incident's magnitude is estimated and validated Loosely related Only shares CSF RS.AN-08: related, not a mapping
ISO 27001	Clause 6.1.2 Clause 6.1.3 A.8.8 Clause 8.2	Information security risk assessment; Information security risk treatment…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt ControlMapping editorial: HIPAA's risk analysis is the ISO 27001 risk assessment (6.1.2, 8.2); both NIST crosswalks route it through SP 800-53 RA-3. 13 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-03, ID.RA-05: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.RA-03: related, not a mapping A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-06, GV.SC-03: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-05: related, not a mapping …and 5 more in the downloads
CIS v8.1	CIS 7.1 CIS 7.2 CIS 7.5 CIS 7.6 CIS 7.7 CIS 16.6 CIS 18.1 CIS 18.2 CIS 18.3 CIS 18.4 CIS 18.5	Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process…	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 4 loosely related (not mappings) CIS 3.7 Establish and Maintain a Data Classification Scheme Loosely related Only shares CSF ID.AM-05: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-05: related, not a mapping
SOC 2	CC3.2 CC3.3 CC3.4 CC7.1	Risk identification and analysis; Considering the potential for fraud…	Editorial	Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) 5 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-05: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC5.1 Control activities that mitigate risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.RM-06: related, not a mapping
PCI DSS	12.3.1 6.3.1 11.3.1 11.3.2	Targeted risk analysis for flexible-frequency requirements; Vulnerabilities identified and risk-ranked…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt 36 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.IM-03, ID.RA-05: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-09, ID.AM-05: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-03, GV.SC-09, ID.RA-01: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.AM-05: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-10, RS.AN-08: related, not a mapping …and 28 more in the downloads
CMMC	RA.L2-3.11.1 RA.L2-3.11.2 RA.L2-3.11.3	Risk Assessments; Vulnerability Scan…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt 8 loosely related (not mappings) CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.3 Security Alerts & Advisories Loosely related Only shares CSF ID.RA-01, ID.RA-03: related, not a mapping MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-05: related, not a mapping
800-53	RA-3 RA-7 CA-8 RA-5 RA-2	Risk Assessment; Risk Response…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt NIST HIPAA → SP 800-53 crosswalk 26 loosely related (not mappings) PM-9 Risk Management Strategy Loosely related Only shares CSF GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09…: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.IM-01, ID.IM-02…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09: related, not a mapping …and 18 more in the downloads
GDPR	Art.32(1)(d)Art.35(1)Art.35(7)	Security of processing; Data protection impact assessment…	Editorial	Same topic: Vulnerability Mgmt, Risk Assessment (editorial pick) 3 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-06: related, not a mapping
NIS2	2.1 6.5 6.10	Risk management framework; Security testing…	Crosswalk	Same topic: Risk Assessment, Vulnerability Mgmt 5 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-07: related, not a mapping 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures Loosely related Only shares CSF GV.RM-06: related, not a mapping 12.1 Asset classification Loosely related Only shares CSF ID.AM-05: related, not a mapping
Essential Eight	ISM-1698 ISM-1699 ISM-1701 ISM-1702 ISM-1807 ISM-1808	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates……	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 23 loosely related (not mappings) ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads
DORA	Art.8(2)Art.8(3)Art.8(7)Art.25(1)Art.26(1)Art.27(1)	Identification; Identification…	Editorial	Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) 11 loosely related (not mappings) Art.13(1) Learning and evolving Loosely related Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping Art.5(2)(a) Governance and organisation Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.6(1) ICT risk management framework Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.6(8) ICT risk management framework Loosely related Only shares CSF GV.RM-06: related, not a mapping …and 3 more in the downloads
CPS 234	Para 17 Para 21 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle…	Editorial	Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) 6 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-05: related, not a mapping Para 31 Review the testing programme at least annually Loosely related Only shares CSF GV.RM-06: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Vulnerability Mgmt (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.