HIPAA · §164.308 Administrative safeguards
§164.308(a)(1)(ii)(C)
Sanction Policy
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0DE.CM-03 GV.RR-04
topicsInsider Threat
frameworks1 7 2
Official textApply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-03GV.RR-04 | Personnel activity and technology usage are monitored to find potentially adverse events; Cybersecurity is included in human resources practices | Editorial | Same topic: Insider Threat (editorial pick) |
| ISO 27001 | A.6.1A.6.4A.8.16 | Screening; Disciplinary process… | Editorial | Same topic: Insider Threat (editorial pick) |
| CIS v8.1 | CIS 6.1CIS 6.2CIS 10.7CIS 13.6 | Establish an Access Granting Process; Establish an Access Revoking Process… | No mapping. Only shares CSF GV.RR-04, DE.CM-03: related, not a mapping | |
| SOC 2 | CC7.2 | Monitoring system components for anomalies | No mapping. Only shares CSF DE.CM-03: related, not a mapping | |
| PCI DSS | 10.2.112.7.1 | Audit logs enabled and active; Personnel screened before hire | Editorial | Same topic: Insider Threat (editorial pick)7 loosely related (not mappings)7.2.2 Access assigned by job function and least privilege Only shares CSF GV.RR-04: related, not a mapping 8.2.2 Shared or generic accounts only by documented exception Only shares CSF DE.CM-03: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Only shares CSF GV.RR-04: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Only shares CSF DE.CM-03: related, not a mapping 12.6.3 Awareness training on hire and at least annually Only shares CSF GV.RR-04: related, not a mapping |
| CMMC | AT.L2-3.2.3AU.L2-3.3.2PS.L2-3.9.1 | Insider Threat Awareness; User Accountability… | Editorial | Same topic: Insider Threat (editorial pick)5 loosely related (not mappings) |
| 800-53 | AC-2(12)AU-13PM-12PS-8 | Account Monitoring for Atypical Usage; Monitoring for Information Disclosure… | Crosswalk | Same topic: Insider Threat (editorial pick) NIST HIPAA → SP 800-53 crosswalk 8 loosely related (not mappings) |
| GDPR | Art.29Art.32(4) | Processing under the authority of the controller or processor; Security of processing | Editorial | Same topic: Insider Threat (editorial pick) |
| NIS2 | 10.210.4 | Verification of Background; Disciplinary process | Editorial | Same topic: Insider Threat (editorial pick) |
| Essential Eight | ISM-0109ISM-1906ISM-1907 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | No mapping. Only shares CSF DE.CM-03: related, not a mapping | |
| DORA | Art.10(3) | Detection | Editorial | Same topic: Insider Threat (editorial pick)1 loosely related (not mappings) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.