Security Awareness and Training

frameworkHIPAA Security Rule section§164.308 Administrative safeguards csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.AT-01 PR.AT-02 topicsAwareness & Training frameworks7 3 2

Official textImplement a security awareness and training program for all members of its workforce (including management).45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(5) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Crosswalk	Same topic: Awareness & Training 5 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping
ISO 27001	A.6.3 Clause 7.3	Information security awareness, education and training; Awareness	Crosswalk	Same topic: Awareness & Training 23 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping A.5.2 Information security roles and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping A.5.5 Contact with authorities Loosely related Only shares CSF GV.OV-01: related, not a mapping …and 15 more in the downloads
CIS v8.1	CIS 14.1 CIS 14.9 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training…	Crosswalk	Same topic: Awareness & Training
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick) 5 loosely related (not mappings) CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	12.6.1 12.6.3	Formal security awareness programme; Awareness training on hire and at least annually	Crosswalk	Same topic: Awareness & Training 41 loosely related (not mappings) 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-03, ID.IM-01: related, not a mapping 12.4.2 Service providers: quarterly reviews of operational tasks Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.4.2.1 Service providers: quarterly review results documented Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-03, ID.IM-02: related, not a mapping …and 33 more in the downloads
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Crosswalk	Same topic: Awareness & Training 2 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping
800-53	AT-2 AT-3 AT-1 AT-4	Literacy Training and Awareness; Role-based Training…	Crosswalk	Same topic: Awareness & Training NIST HIPAA → SP 800-53 crosswalk 30 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 22 more in the downloads
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03: related, not a mapping
NIS2	8.1 8.2	Awareness raising and basic cyber hygiene practices; Security training	Crosswalk	Same topic: Awareness & Training 7 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AT-02: related, not a mapping 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF PR.AT-02: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF PR.AT-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.13(6)	Governance and organisation; Learning and evolving	Editorial	Same topic: Awareness & Training (editorial pick) 9 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-03: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03: related, not a mapping …and 1 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 22	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping +3 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.