HIPAA · §164.308 Administrative safeguards
§164.308(a)(5)(ii)(B)
Protection from Malicious Software
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusAddressable
csf 2.0DE.CM-09 PR.AT-01 PR.AT-02 PR.PS-05
topicsEndpoint Protection
frameworks1 9 1
Official textGuarding against, detecting, and reporting malicious software;45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-09PR.PS-05 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; Installation and execution of unauthorized software are prevented | Editorial | Same topic: Endpoint Protection (editorial pick)2 loosely related (not mappings)PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind Only shares CSF PR.AT-01: related, not a mapping PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Only shares CSF PR.AT-02: related, not a mapping |
| ISO 27001 | A.8.1A.8.7A.8.19 | User endpoint devices; Protection against malware… | Editorial | Same topic: Endpoint Protection (editorial pick) |
| CIS v8.1 | CIS 2.5CIS 2.6CIS 2.7CIS 10.1CIS 10.2CIS 10.3CIS 10.4CIS 10.5CIS 10.6CIS 10.7 | Allowlist Authorized Software; Allowlist Authorized Libraries… | Editorial | Same topic: Endpoint Protection (editorial pick)15 loosely related (not mappings)CIS 14.1 Establish and Maintain a Security Awareness Program Only shares CSF PR.AT-01: related, not a mapping CIS 14.9 Conduct Role-Specific Security Awareness and Skills Training Only shares CSF PR.AT-02: related, not a mapping CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping CIS 14.3 Train Workforce Members on Authentication Best Practices Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping CIS 14.4 Train Workforce on Data Handling Best Practices Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping CIS 14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping …and 7 more in the downloads |
| SOC 2 | CC6.8 | Preventing or detecting unauthorized or malicious software | Editorial | Same topic: Endpoint Protection (editorial pick) |
| PCI DSS | 5.2.15.2.25.3.2 | Anti-malware deployed on system components; Anti-malware detects, removes or contains known malware… | Editorial | Same topic: Endpoint Protection (editorial pick)12 loosely related (not mappings)6.2.2 Developers trained in secure software development Only shares CSF PR.AT-02: related, not a mapping 12.6.3 Awareness training on hire and at least annually Only shares CSF PR.AT-01: related, not a mapping 12.10.4.1 Training frequency set by targeted risk analysis Only shares CSF PR.AT-02: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.CM-09, PR.PS-05: related, not a mapping 2.2.1 System configuration standards developed and maintained Only shares CSF PR.PS-05: related, not a mapping 5.4.1 Mechanisms to detect and protect against phishing Only shares CSF DE.CM-09: related, not a mapping …and 4 more in the downloads |
| CMMC | SI.L2-3.14.2SI.L2-3.14.4 | Malicious Code Protection; Update Malicious Code Protection | Editorial | Same topic: Endpoint Protection (editorial pick)13 loosely related (not mappings)…and 5 more in the downloads |
| 800-53 | CM-7(5)SI-3SI-4AT-2AT-3 | Authorized Software — Allow-by-exception; Malicious Code Protection… | Crosswalk | Same topic: Endpoint Protection (editorial pick) NIST HIPAA → SP 800-53 crosswalk 13 loosely related (not mappings)…and 5 more in the downloads |
| GDPR | Art.39(1)(b) | Tasks of the data protection officer | No mapping. Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping | |
| NIS2 | 6.9 | Protection against malicious and unauthorised software | Editorial | Same topic: Endpoint Protection (editorial pick) |
| Essential Eight | ISM-0843ISM-1488ISM-1490ISM-1544ISM-1657ISM-1870 | Application control is implemented on workstations; Microsoft Office macros in files originating from the internet are blocked… | Editorial | Same topic: Endpoint Protection (editorial pick)20 loosely related (not mappings)ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Only shares CSF DE.CM-09: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Only shares CSF DE.CM-09: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Only shares CSF PR.PS-05: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Only shares CSF PR.PS-05: related, not a mapping ISM-1582 Application control rulesets are validated at least annually Only shares CSF PR.PS-05: related, not a mapping ISM-1656 Application control is implemented on non-internet-facing servers Only shares CSF PR.PS-05: related, not a mapping ISM-1658 Application control restricts the execution of drivers to an organisation-approved set Only shares CSF PR.PS-05: related, not a mapping ISM-1659 Microsoft’s vulnerable driver blocklist is implemented Only shares CSF PR.PS-05: related, not a mapping …and 12 more in the downloads |
| DORA | Art.5(4)Art.13(6)Art.9(1)Art.10(1) | Governance and organisation; Learning and evolving… | No mapping. Only shares CSF PR.AT-01, PR.AT-02, DE.CM-09: related, not a mapping+1 more loosely related (not mappings) | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 5 | Malware protection | Editorial | Same topic: Endpoint Protection (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.