Termination Procedures

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusAddressable csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.RR-04 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 topics— frameworks1 0 2

Official textImplement procedures for terminating access to ePHI when the employment of or other arrangement with a workforce member ends or as required by determinations made as specified in §164.308(a)(3)(ii)(B).45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(3)(ii)(C) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02: related, not a mapping +2 more loosely related (not mappings) GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping
ISO 27001	A.5.1 A.5.19 A.5.20 A.5.31	Policies for information security; Information security in supplier relationships…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping +21 more loosely related (not mappings) A.6.1 Screening Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping A.6.4 Disciplinary process Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.PO-01, GV.RR-04: related, not a mapping …and 17 more in the downloads
CIS v8.1	CIS 6.1 CIS 6.2	Establish an Access Granting Process; Establish an Access Revoking Process	Loosely related	No mapping. Only shares CSF GV.RR-04: related, not a mapping
SOC 2	CC1.1 CC5.3 CC4.1 CC4.2	Commitment to integrity and ethical values; Control activities deployed through policies and procedures…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03: related, not a mapping +1 more loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	10.7.1 10.7.2 12.1.2 12.3.1	Service providers detect security control failures; Critical security control failures detected and reported…	Loosely related	No mapping. Only shares CSF GV.OV-01, ID.IM-03, GV.PO-01, GV.PO-02…: related, not a mapping +40 more loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-03, ID.IM-01: related, not a mapping 12.4.2 Service providers: quarterly reviews of operational tasks Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.4.2.1 Service providers: quarterly review results documented Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-03, ID.IM-02: related, not a mapping …and 36 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.1 AT.L2-3.2.3 AU.L2-3.3.2	Risk Assessments; Security Control Assessment…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping +1 more loosely related (not mappings) PS.L2-3.9.1 Screen Individuals Loosely related Only shares CSF GV.RR-04: related, not a mapping
800-53	PS-1 PS-4 PS-5	Policy and Procedures; Personnel Termination…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 35 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 27 more in the downloads
GDPR	Art.24(2)Art.5(2)Art.28(1)Art.29	Responsibility of the controller; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03, GV.SC-03…: related, not a mapping +1 more loosely related (not mappings) Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	1.1 5.1 6.1 10.1	Policy on the security of network and information systems; Supply chain security policy…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, GV.RR-04: related, not a mapping +4 more loosely related (not mappings) 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)Art.5(2)(f)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03: related, not a mapping +6 more loosely related (not mappings) Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-03: related, not a mapping …and 2 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 22	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping +3 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.