HIPAA · §164.308 Administrative safeguards
§164.308(a)(1)(ii)(B)
Risk Management
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0DE.AE-07 GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-09 GV.SC-10 ID.AM-03 ID.AM-05 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 ID.RA-01 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-08 RS.AN-08
topicsRisk Management, Vulnerability Mgmt
frameworks1 12 0
Official textImplement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a)45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06ID.RA-01ID.RA-08 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)12 loosely related (not mappings)DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Only shares CSF DE.AE-07: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Only shares CSF ID.AM-03: related, not a mapping ID.AM-05 Assets are prioritized based on classification, criticality, resources, and impact on the mission Only shares CSF ID.AM-05: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping …and 4 more in the downloads |
| ISO 27001 | A.8.8Clause 6.1.1Clause 6.1.3Clause 8.3 | Management of technical vulnerabilities; General… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick) ControlMapping editorial: HIPAA's risk management (reduce risk to a reasonable level) is ISO 27001 risk treatment (6.1.3, 8.3). 22 loosely related (not mappings)Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06, GV.SC-09…: related, not a mapping A.5.1 Policies for information security Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06…: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-08…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.9 Inventory of information and other associated assets Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping …and 14 more in the downloads |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| SOC 2 | CC3.1CC5.1CC7.1CC9.1 | Objectives specified clearly enough to identify risks; Control activities that mitigate risks… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)7 loosely related (not mappings)CC3.2 Risk identification and analysis Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.3 Considering the potential for fraud Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.4 Identifying and assessing significant changes Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping C1.1 Identifying and protecting confidential information Only shares CSF ID.AM-05: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF ID.AM-08: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF ID.AM-03: related, not a mapping |
| PCI DSS | 6.3.111.3.111.3.212.3.1 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick)47 loosely related (not mappings)12.3.4 Hardware and software technologies reviewed annually Only shares CSF DE.AE-07, GV.RM-03, GV.RM-06, GV.SC-03…: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.AM-08…: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06, GV.SC-09, ID.AM-05: related, not a mapping 12.8.3 Due diligence before engaging service providers Only shares CSF GV.RM-03, GV.RM-06, GV.SC-03, GV.SC-10: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.SC-10, ID.AM-03, RS.AN-08: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-10, ID.AM-03, RS.AN-08: related, not a mapping …and 39 more in the downloads |
| CMMC | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3 | Risk Assessments; Vulnerability Scan… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)12 loosely related (not mappings)CA.L2-3.12.4 System Security Plan Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR.L2-3.6.1 Incident Handling Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping …and 4 more in the downloads |
| 800-53 | CA-8PM-9PM-28RA-5RA-7PL-2RA-2RA-3 | Penetration Testing; Risk Management Strategy… | Crosswalk | Same topic: Vulnerability Mgmt, Risk Management (editorial pick) NIST HIPAA → SP 800-53 crosswalk 43 loosely related (not mappings)SR-2 Supply Chain Risk Management Plan Only shares CSF GV.RM-01, GV.RM-03, GV.SC-03, GV.SC-09…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-01…: related, not a mapping IR-8 Incident Response Plan Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04…: related, not a mapping PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06, GV.RM-07, GV.SC-03…: related, not a mapping PM-31 Continuous Monitoring Strategy Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10, ID.IM-02…: related, not a mapping CA-2 Control Assessments Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-7 Continuous Monitoring Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-4 Incident Handling Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping …and 35 more in the downloads |
| GDPR | Art.24(1)Art.32(1)(d)Art.32(2) | Responsibility of the controller; Security of processing… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| NIS2 | 2.16.56.107.1 | Risk management framework; Security testing… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)7 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)23 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads |
| DORA | Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.16(1)Art.24(1)Art.25(1)Art.26(1)Art.27(1) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)11 loosely related (not mappings)Art.29(1) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping …and 3 more in the downloads |
| CPS 234 | Para 13Para 15Para 17Para 27Para 30Para 31 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Para 16 Assess third parties' information security capability Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.