HIPAA · §164.308 Administrative safeguards
§164.308(a)(1)(ii)(D)
Information System Activity Review
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02 DE.CM-03 DE.CM-06 DE.CM-09 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-07 PR.DS-01 PR.DS-02 PR.DS-10 PR.PS-04 RC.CO-03 RS.AN-03 RS.AN-06 RS.AN-07 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04
topicsCont. Monitoring, SIEM / SOC
frameworks7 3 0
Official textImplement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-03DE.AE-06DE.AE-08DE.CM-01DE.CM-03DE.CM-09 | Information is correlated from multiple sources; Information on adverse events is provided to authorized staff and tools… | Crosswalk | Same topic: SIEM / SOC, Cont. Monitoring19 loosely related (not mappings)DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Only shares CSF DE.AE-02: related, not a mapping DE.CM-02 The physical environment is monitored to find potentially adverse events Only shares CSF DE.CM-02: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Only shares CSF DE.CM-06: related, not a mapping ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded Only shares CSF ID.RA-01: related, not a mapping ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked Only shares CSF ID.RA-07: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Only shares CSF PR.DS-10: related, not a mapping …and 11 more in the downloads |
| ISO 27001 | A.5.25A.8.16 | Assessment and decision on information security events; Monitoring activities | Crosswalk | Same topic: SIEM / SOC, Cont. Monitoring48 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping A.5.28 Collection of evidence Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.MA-01…: related, not a mapping A.5.27 Learning from information security incidents Only shares CSF ID.IM-03, RS.AN-03, RS.MA-01, RS.MA-02: related, not a mapping A.8.17 Clock synchronization Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-04: related, not a mapping A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 40 more in the downloads |
| CIS v8.1 | CIS 13.1CIS 8.9CIS 13.6CIS 13.11 | Centralize Security Event Alerting; Centralize Audit Logs… | Crosswalk | Same topic: Cont. Monitoring, SIEM / SOC65 loosely related (not mappings)CIS 17.7 Conduct Routine Incident Response Exercises Only shares CSF ID.IM-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping CIS 10.7 Use Behavior-Based Anti-Malware Software Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping CIS 7.1 Establish and Maintain a Vulnerability Management Process Only shares CSF ID.RA-01: related, not a mapping …and 57 more in the downloads |
| SOC 2 | CC7.2CC7.3 | Monitoring system components for anomalies; Evaluating security events to determine if they are incidents | Editorial | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick)12 loosely related (not mappings)CC7.4 Responding to identified security incidents Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07, RS.MA-01…: related, not a mapping C1.2 Disposing of confidential information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC2.3 Communication with external parties Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping CC7.5 Recovering from identified security incidents Only shares CSF ID.IM-03, RC.CO-03: related, not a mapping …and 4 more in the downloads |
| PCI DSS | 10.4.1 | Security event and critical logs reviewed daily | Crosswalk | Same topic: Cont. Monitoring, SIEM / SOC68 loosely related (not mappings)10.2.1 Audit logs enabled and active Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping 10.3.3 Logs promptly backed up to a central server Only shares CSF DE.AE-02, DE.AE-03, PR.PS-04, RS.AN-06…: related, not a mapping 10.3.4 File-integrity monitoring on logs Only shares CSF DE.AE-02, DE.CM-09, PR.PS-04, RS.AN-06: related, not a mapping 10.6.1 System clocks synchronised Only shares CSF DE.CM-03, PR.PS-04, RS.AN-06, RS.AN-07: related, not a mapping 12.8.2 Written agreements with service providers Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF DE.CM-06, ID.IM-02, RC.CO-03, RS.CO-03: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-02, RS.MA-01, RS.MA-03, RS.MA-04: related, not a mapping …and 60 more in the downloads |
| CMMC | AU.L2-3.3.5SI.L2-3.14.6SI.L2-3.14.7 | Audit Correlation; Monitor Communications for Attacks… | Crosswalk | Same topic: SIEM / SOC, Cont. Monitoring50 loosely related (not mappings)IR.L2-3.6.1 Incident Handling Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping IR.L2-3.6.2 Incident Reporting Only shares CSF DE.AE-03, RC.CO-03, RS.AN-06, RS.AN-07…: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping IR.L2-3.6.3 Incident Response Testing Only shares CSF ID.IM-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping AU.L2-3.3.3 Event Review Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.PS-04: related, not a mapping AU.L2-3.3.6 Reduction & Reporting Only shares CSF PR.PS-04, RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping …and 42 more in the downloads |
| 800-53 | AU-6AU-6(3)CA-7IR-5SI-4AU-7IR-6 | Audit Record Review, Analysis, and Reporting; Correlate Audit Record Repositories… | Crosswalk | Same topic: SIEM / SOC, Cont. Monitoring NIST HIPAA → SP 800-53 crosswalk 69 loosely related (not mappings)IR-4 Incident Handling Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping IR-3 Incident Response Testing Only shares CSF ID.IM-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping IR-8 Incident Response Plan Only shares CSF DE.AE-03, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping AU-12 Audit Record Generation Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.PS-04: related, not a mapping CA-2 Control Assessments Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-8 Penetration Testing Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR-7 Incident Response Assistance Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping …and 61 more in the downloads |
| GDPR | Art.33(1)Art.33(5)Art.5(1)(e)Art.5(1)(f) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority… | No mapping. Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping+9 more loosely related (not mappings)Art.32(1)(b) Security of processing Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 5 more in the downloads | |
| NIS2 | 3.23.4 | Monitoring and logging; Event assessment and classification | Crosswalk | Same topic: Cont. Monitoring, SIEM / SOC15 loosely related (not mappings)3.5 Incident response Only shares CSF RC.CO-03, RS.AN-03, RS.CO-02, RS.CO-03…: related, not a mapping 4.3 Crisis management Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, RS.CO-02…: related, not a mapping 6.9 Protection against malicious and unauthorised software Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping …and 7 more in the downloads |
| Essential Eight | ISM-0109ISM-1228ISM-1906ISM-1907 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Cyber security events are analysed in a timely manner to identify cyber security incidents… | Editorial | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick)43 loosely related (not mappings)ISM-1819 Following the identification of a cyber security incident, the cyber security incident… Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping ISM-1509 Privileged access events are centrally logged Only shares CSF DE.AE-03, PR.PS-04: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Only shares CSF DE.AE-03, PR.PS-04: related, not a mapping ISM-1660 Allowed and blocked application control events are centrally logged Only shares CSF DE.AE-03, PR.PS-04: related, not a mapping ISM-1683 Successful and unsuccessful multi-factor authentication events are centrally logged Only shares CSF DE.AE-03, PR.PS-04: related, not a mapping ISM-1815 Event logs are protected from unauthorised modification and deletion Only shares CSF DE.AE-03, PR.PS-04: related, not a mapping ISM-0123 Cyber security incidents are reported to the chief information security officer, or one… Only shares CSF RS.CO-02: related, not a mapping …and 35 more in the downloads |
| DORA | Art.9(1)Art.10(2)Art.10(3) | Protection and prevention; Detection… | Editorial | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick)32 loosely related (not mappings)Art.18(1) Classification of ICT-related incidents and cyber threats Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping Art.11(2)(b) Response and recovery Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.13(2) Learning and evolving Only shares CSF ID.IM-03, RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping Art.17(1) ICT-related incident management process Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.17(3) ICT-related incident management process Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.9(2) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 24 more in the downloads |
| CPS 234 | Para 23Para 25Para 24Para 26 | Detect and respond to incidents in a timely manner; Response plans cover all stages and escalation… | No mapping. Only shares CSF DE.AE-02, DE.CM-01, RS.MA-01, RS.MA-02…: related, not a mapping+10 more loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Para 16 Assess third parties' information security capability Only shares CSF DE.CM-06: related, not a mapping Para 17 Keep capability current as threats and vulnerabilities change Only shares CSF ID.RA-01: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF DE.CM-06: related, not a mapping …and 6 more in the downloads | |
| Cyber Essentials | CE 3CE 5 | Security Update Management; Malware protection | No mapping. Only shares CSF ID.RA-01, DE.CM-09: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.