HIPAA · §164.308 Administrative safeguards
§164.308(a)(4)(ii)(B)
Access Authorization
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusAddressable
csf 2.0DE.CM-01 DE.CM-03 DE.CM-06 DE.CM-09 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.RR-04 GV.SC-03 ID.AM-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-01 PR.AA-05 PR.DS-10 PR.IR-01
topics—
frameworks1 0 0
Official textImplement policies and procedures for granting access to ePHI, such as through access to a workstation, transaction, program, process, or other mechanism.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-01DE.CM-03DE.CM-06DE.CM-09 | Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09: related, not a mapping+11 more loosely related (not mappings)GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Only shares CSF GV.PO-02: related, not a mapping …and 7 more in the downloads | |
| ISO 27001 | A.5.1A.8.16A.5.14A.5.15 | Policies for information security; Monitoring activities… | No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping+48 more loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.6.2 Terms and conditions of employment Only shares CSF GV.PO-01, GV.RR-04, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Only shares CSF GV.PO-01, GV.RR-04, PR.DS-10: related, not a mapping …and 44 more in the downloads | |
| CIS v8.1 | CIS 6.1CIS 6.2CIS 3.12CIS 5.1 | Establish an Access Granting Process; Establish an Access Revoking Process… | No mapping. Only shares CSF GV.RR-04, PR.AA-01, PR.AA-05, PR.DS-10…: related, not a mapping+60 more loosely related (not mappings)CIS 10.7 Use Behavior-Based Anti-Malware Software Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping …and 56 more in the downloads | |
| SOC 2 | CC6.6CC7.2CC9.2CC1.1 | Protection against threats from outside system boundaries; Monitoring system components for anomalies… | No mapping. Only shares CSF DE.CM-01, ID.AM-03, PR.AA-05, PR.IR-01…: related, not a mapping+10 more loosely related (not mappings)CC5.3 Control activities deployed through policies and procedures Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 6 more in the downloads | |
| PCI DSS | 10.2.11.2.46.4.37.2.2 | Audit logs enabled and active; Accurate account-data flow diagram maintained… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, PR.IR-01…: related, not a mapping+82 more loosely related (not mappings)12.8.4 Service provider compliance monitored annually Only shares CSF DE.CM-06, GV.OC-03, ID.IM-02: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping 5.2.1 Anti-malware deployed on system components Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping …and 78 more in the downloads | |
| CMMC | CM.L2-3.4.9CA.L2-3.12.3SC.L2-3.13.3SI.L2-3.14.6 | User-Installed Software; Security Control Monitoring… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-06, DE.CM-09…: related, not a mapping+53 more loosely related (not mappings)SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF DE.CM-01, DE.CM-06, DE.CM-09, ID.IM-01…: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping AC.L2-3.1.1 Authorized Access Control Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping RA.L2-3.11.1 Risk Assessments Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 49 more in the downloads | |
| 800-53 | AC-1AC-2AC-3AC-4PS-6PS-7 | Policy and Procedures; Account Management… | Crosswalk | NIST HIPAA → SP 800-53 crosswalk97 loosely related (not mappings)IA-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping PS-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 89 more in the downloads |
| GDPR | Art.28(1)Art.32(1)(b)Art.24(2)Art.25(2) | Processor; Security of processing… | No mapping. Only shares CSF DE.CM-06, GV.SC-03, PR.IR-01, PR.AA-01…: related, not a mapping+6 more loosely related (not mappings)Art.29 Processing under the authority of the controller or processor Only shares CSF DE.CM-03, GV.RR-04: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-10: related, not a mapping …and 2 more in the downloads | |
| NIS2 | 1.14.36.76.9 | Policy on the security of network and information systems; Crisis management… | No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, DE.CM-01…: related, not a mapping+15 more loosely related (not mappings)6.1 Security in acquisition of ICT services, ICT systems or ICT products Only shares CSF GV.PO-02: related, not a mapping …and 11 more in the downloads | |
| Essential Eight | ISM-0109ISM-1906ISM-1907ISM-0445 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-05: related, not a mapping+26 more loosely related (not mappings)ISM-0843 Application control is implemented on workstations Only shares CSF DE.CM-09: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Only shares CSF PR.AA-05: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.CM-09: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Only shares CSF PR.AA-05: related, not a mapping …and 22 more in the downloads | |
| DORA | Art.10(3)Art.9(1)Art.5(2)(b)Art.6(5) | Detection; Protection and prevention… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, GV.RR-04…: related, not a mapping+20 more loosely related (not mappings)…and 16 more in the downloads | |
| CPS 234 | Para 16Para 18Para 19Para 22 | Assess third parties' information security capability; Maintain an information security policy framework… | No mapping. Only shares CSF DE.CM-06, GV.SC-03, GV.PO-01, GV.PO-02: related, not a mapping+6 more loosely related (not mappings)Para 34 Internal audit assesses third-party assurance relied on Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF PR.DS-10: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Only shares CSF DE.CM-01: related, not a mapping Para 28 Check third parties' control testing is adequate Only shares CSF DE.CM-06: related, not a mapping …and 2 more in the downloads | |
| Cyber Essentials | CE 4CE 1CE 2CE 5 | User Access Control; Firewalls… | No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01, ID.AM-03…: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.