Workforce Security

frameworkHIPAA Security Rule section§164.308 Administrative safeguards csf 2.0DE.CM-01 DE.CM-03 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-01 PR.AA-05 PR.DS-10 PR.IR-01 topics— frameworks1 0 0

Official textImplement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(3) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-01 DE.CM-03 GV.OC-03 GV.OV-01	Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, GV.OC-03, GV.OV-01: related, not a mapping +7 more loosely related (not mappings) GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 3 more in the downloads
ISO 27001	A.5.1 A.5.15 A.5.19 A.8.2	Policies for information security; Access control…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping +41 more loosely related (not mappings) Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02, PR.DS-10: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF DE.CM-03, GV.OV-01, ID.IM-03: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 37 more in the downloads
CIS v8.1	CIS 3.12 CIS 5.1 CIS 3.3 CIS 5.6	Segment Data Processing and Storage Based on Sensitivity; Establish and Maintain an Inventory of Accounts…	Loosely related	No mapping. Only shares CSF PR.DS-10, PR.IR-01, PR.AA-01, PR.AA-05: related, not a mapping +42 more loosely related (not mappings) CIS 6.7 Centralize Access Control Loosely related Only shares CSF PR.AA-01: related, not a mapping CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 38 more in the downloads
SOC 2	CC6.6 CC1.1 CC5.3 CC6.1	Protection against threats from outside system boundaries; Commitment to integrity and ethical values…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01, GV.PO-01…: related, not a mapping +9 more loosely related (not mappings) CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 5 more in the downloads
PCI DSS	10.2.1 1.2.4 3.2.1 6.4.3	Audit logs enabled and active; Accurate account-data flow diagram maintained…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.IR-01, GV.OC-03…: related, not a mapping +71 more loosely related (not mappings) 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 67 more in the downloads
CMMC	CM.L2-3.4.9 SC.L2-3.13.2 SC.L2-3.13.3 AC.L2-3.1.1	User-Installed Software; Security Engineering…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping +51 more loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping …and 47 more in the downloads
800-53	AC-1 AC-2 AC-3 AC-5 AC-6	Policy and Procedures; Account Management…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 83 loosely related (not mappings) IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 75 more in the downloads
GDPR	Art.32(1)(b)Art.24(2)Art.25(2)Art.28(1)	Security of processing; Responsibility of the controller…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10, GV.PO-01…: related, not a mapping +5 more loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping …and 1 more in the downloads
NIS2	1.1 6.7 11.5 4.3	Policy on the security of network and information systems; Network security…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, DE.CM-01…: related, not a mapping +10 more loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 6 more in the downloads
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-0445	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping +19 more loosely related (not mappings) ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 15 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(1)Art.9(4)(a)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, DE.CM-01, DE.CM-03: related, not a mapping +16 more loosely related (not mappings) Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 12 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 21	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03, PR.DS-10: related, not a mapping +5 more loosely related (not mappings) Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF DE.CM-01: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads
Cyber Essentials	CE 4 CE 1 CE 2	User Access Control; Firewalls…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.