HIPAA · §164.308 Administrative safeguards
§164.308(a)(7)(ii)(B)
Disaster Recovery Plan
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0GV.OC-04 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.DS-01 PR.DS-10 PR.DS-11 PR.IR-02 PR.IR-04 RC.CO-04 RC.RP-01 RC.RP-02 RC.RP-03 RC.RP-05
topicsRecovery Planning, Disaster Recovery
frameworks5 5 1
Official textEstablish (and implement as needed) procedures to restore any loss of data.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-04PR.IR-03RC.RP-01RC.RP-02RC.RP-05 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations… | Crosswalk | Same topic: Recovery Planning, Disaster Recovery8 loosely related (not mappings)GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Only shares CSF GV.OC-04: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Only shares CSF PR.DS-01: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Only shares CSF PR.DS-10: related, not a mapping PR.DS-11 Backups of data are created, protected, maintained, and tested Only shares CSF PR.DS-11: related, not a mapping PR.IR-02 The organization's technology assets are protected from environmental threats Only shares CSF PR.IR-02: related, not a mapping PR.IR-04 Adequate resource capacity to ensure availability is maintained Only shares CSF PR.IR-04: related, not a mapping RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging Only shares CSF RC.CO-04: related, not a mapping RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration Only shares CSF RC.RP-03: related, not a mapping |
| ISO 27001 | A.5.29A.5.30A.8.14 | Information security during disruption; ICT readiness for business continuity… | Crosswalk | Same topic: Recovery Planning, Disaster Recovery43 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-04, PR.DS-01, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping …and 35 more in the downloads |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Recovery Planning, Disaster Recovery (editorial pick)14 loosely related (not mappings)CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RC.CO-04: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Only shares CSF RC.CO-04: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping …and 6 more in the downloads |
| SOC 2 | A1.2A1.3CC7.5 | Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures… | Editorial | Same topic: Disaster Recovery, Recovery Planning (editorial pick)9 loosely related (not mappings)C1.2 Disposing of confidential information Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping CC2.3 Communication with external parties Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF GV.OC-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.OC-04: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF PR.DS-01: related, not a mapping …and 1 more in the downloads |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Crosswalk | Same topic: Recovery Planning, Disaster Recovery38 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-02, ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping 12.10.3 Incident response staff available around the clock Only shares CSF ID.IM-04, RC.CO-04, RC.RP-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02: related, not a mapping 9.4.1.1 Offline backup media stored securely Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 9.4.1.2 Security of offline backup location reviewed annually Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF PR.DS-01, PR.DS-11: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.IM-02, RC.RP-05: related, not a mapping …and 30 more in the downloads |
| CMMC | IR.L2-3.6.1SC.L2-3.13.2SI.L2-3.14.6SI.L2-3.14.7 | Incident Handling; Security Engineering… | No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04…: related, not a mapping+24 more loosely related (not mappings)MP.L2-3.8.9 Protect Backups Only shares CSF PR.DS-01, PR.DS-10, PR.DS-11, RC.RP-03: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping …and 20 more in the downloads | |
| 800-53 | CP-2CP-10CP-7CP-6CP-8CP-9 | Contingency Plan; System Recovery and Reconstitution… | Crosswalk | Same topic: Recovery Planning, Disaster Recovery NIST HIPAA → SP 800-53 crosswalk 44 loosely related (not mappings)IR-4 Incident Handling Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04…: related, not a mapping IR-8 Incident Response Plan Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04…: related, not a mapping SI-4 System Monitoring Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01…: related, not a mapping SA-8 Security and Privacy Engineering Principles Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping SC-4 Information in Shared System Resources Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping …and 36 more in the downloads |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Recovery Planning, Disaster Recovery (editorial pick)6 loosely related (not mappings)Art.32(1)(b) Security of processing Only shares CSF GV.OC-04, PR.DS-01, PR.DS-10: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01: related, not a mapping |
| NIS2 | 4.14.2 | Business continuity and disaster recovery plan; Backup management | Crosswalk | Same topic: Recovery Planning, Disaster Recovery4 loosely related (not mappings)13.2 Protection against physical and environmental threats Only shares CSF PR.IR-02: related, not a mapping |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | Editorial | Same topic: Disaster Recovery (editorial pick)10 loosely related (not mappings)ISM-1511 Backups of data, applications and settings are performed and retained in accordance… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1705 Privileged user accounts (excluding backup administrator accounts) cannot access… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1812 Unprivileged user accounts cannot access backups belonging to other user accounts Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 2 more in the downloads |
| DORA | Art.11(3)Art.11(6)Art.12(4)Art.12(6) | Response and recovery; Response and recovery… | Editorial | Same topic: Recovery Planning, Disaster Recovery (editorial pick)16 loosely related (not mappings)Art.12(1) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(2) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(3) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 8 more in the downloads |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.