Access Establishment and Modification

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusAddressable csf 2.0DE.CM-01 DE.CM-03 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-01 PR.AA-05 PR.DS-10 topics— frameworks1 0 0

Official textImplement policies and procedures that – based on the covered entity or business associate’s access authorization policies – establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(4)(ii)(C) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-01 DE.CM-03 GV.OC-03 GV.OV-01	Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, GV.OC-03, GV.OV-01: related, not a mapping +6 more loosely related (not mappings) GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 2 more in the downloads
ISO 27001	A.5.1 A.5.15 A.5.19 A.8.2	Policies for information security; Access control…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping +38 more loosely related (not mappings) Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02, PR.DS-10: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF DE.CM-03, GV.OV-01, ID.IM-03: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 34 more in the downloads
CIS v8.1	CIS 5.1 CIS 3.3 CIS 5.6 CIS 6.7	Establish and Maintain an Inventory of Accounts; Configure Data Access Control Lists…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping +31 more loosely related (not mappings) CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 5.2 Use Unique Passwords Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 27 more in the downloads
SOC 2	CC1.1 CC5.3 CC6.1 CC6.2	Commitment to integrity and ethical values; Control activities deployed through policies and procedures…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, PR.AA-01, PR.AA-05: related, not a mapping +9 more loosely related (not mappings) CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 5 more in the downloads
PCI DSS	3.2.1 7.1.1 7.2.2 8.1.1	Account data storage minimised, with retention and disposal; Access restriction policies documented and kept current…	Loosely related	No mapping. Only shares CSF GV.OC-03, PR.DS-10, GV.PO-02, PR.AA-05: related, not a mapping +61 more loosely related (not mappings) 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping …and 57 more in the downloads
CMMC	CM.L2-3.4.9 AC.L2-3.1.1 CA.L2-3.12.3 RA.L2-3.11.1	User-Installed Software; Authorized Access Control…	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping +51 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping …and 47 more in the downloads
800-53	AC-1 AC-2	Policy and Procedures; Account Management	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 86 loosely related (not mappings) IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 78 more in the downloads
GDPR	Art.32(1)(b)Art.24(2)Art.25(2)Art.5(1)(e)	Security of processing; Responsibility of the controller…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10, GV.PO-01…: related, not a mapping +5 more loosely related (not mappings) Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping …and 1 more in the downloads
NIS2	1.1 11.5 4.3 5.1	Policy on the security of network and information systems; Identification…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AA-01…: related, not a mapping +9 more loosely related (not mappings) 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.7 Network security Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 5 more in the downloads
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-0445	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping +19 more loosely related (not mappings) ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 15 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(1)Art.9(4)(a)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, DE.CM-01, DE.CM-03: related, not a mapping +13 more loosely related (not mappings) Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 9 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 21	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03, PR.DS-10: related, not a mapping +5 more loosely related (not mappings) Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF DE.CM-01: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads
Cyber Essentials	CE 4 CE 2	User Access Control; Secure Configuration	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.