HIPAA · §164.308 Administrative safeguards
§164.308(a)(2)
Assigned Security Responsibility
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
csf 2.0GV.RR-01 GV.RR-02
topicsRoles & Responsibilities
frameworks5 4 3
Official textIdentify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RR-01GV.RR-02GV.RR-03 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced… | Crosswalk | Same topic: Roles & Responsibilities |
| ISO 27001 | A.5.2A.5.4 | Information security roles and responsibilities; Management responsibilities | Crosswalk | Same topic: Roles & Responsibilities2 loosely related (not mappings) |
| CIS v8.1 | CIS 14.1CIS 14.9 | Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training | No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| SOC 2 | CC1.2CC1.3CC1.5 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| PCI DSS | 12.1.312.1.4 | Security roles and responsibilities defined; Executive responsibility for information security assigned | Crosswalk | Same topic: Roles & Responsibilities14 loosely related (not mappings)3.1.2 Roles for protecting stored account data assigned Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF GV.RR-01: related, not a mapping …and 6 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PM-2PM-29PS-9CA-6 | Information Security Program Leadership Role; Risk Management Program Leadership Roles… | Crosswalk | Same topic: Roles & Responsibilities NIST HIPAA → SP 800-53 crosswalk 4 loosely related (not mappings) |
| GDPR | Art.37(1)Art.39(1) | Designation of the data protection officer; Tasks of the data protection officer | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| NIS2 | 1.2 | Roles, responsibilities and authorities | Crosswalk | Same topic: Roles & Responsibilities |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(c)Art.5(3)Art.6(4) | Governance and organisation; Governance and organisation… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| CPS 234 | Para 13Para 14 | Board ultimately responsible for information security; Define information security roles and responsibilities | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.