HIPAA · §164.308 Administrative safeguards
§164.308(a)(7)(ii)(C)
Emergency Mode Operation Plan
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0GV.OC-04 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.IR-02 RC.CO-04 RC.RP-01 RC.RP-02 RC.RP-03 RC.RP-05
topicsBusiness Continuity
frameworks5 3 2
Official textEstablish (and implement as needed) procedures to enable the continuation of critical business processes to protect the security of ePHI while operating in emergency mode.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-04PR.IR-03RC.RP-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations… | Crosswalk | Same topic: Business Continuity6 loosely related (not mappings)PR.IR-02 The organization's technology assets are protected from environmental threats Only shares CSF PR.IR-02: related, not a mapping RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging Only shares CSF RC.CO-04: related, not a mapping RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process Only shares CSF RC.RP-01: related, not a mapping RC.RP-02 Recovery actions are selected, scoped, prioritized, and performed Only shares CSF RC.RP-02: related, not a mapping RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration Only shares CSF RC.RP-03: related, not a mapping RC.RP-05 The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed Only shares CSF RC.RP-05: related, not a mapping |
| ISO 27001 | A.5.29A.5.30A.8.14 | Information security during disruption; ICT readiness for business continuity… | Crosswalk | Same topic: Business Continuity14 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-05: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-04: related, not a mapping A.7.5 Protecting against physical and environmental threats Only shares CSF PR.IR-02: related, not a mapping …and 6 more in the downloads |
| CIS v8.1 | CIS 11.5CIS 17.2CIS 17.6CIS 11.1 | Test Data Recovery; Establish and Maintain Contact Information for Reporting Security Incidents… | No mapping. Only shares CSF RC.RP-03, RC.CO-04, ID.IM-04, RC.RP-01…: related, not a mapping+1 more loosely related (not mappings)CIS 11.4 Establish and Maintain an Isolated Instance of Recovery Data Only shares CSF RC.RP-03: related, not a mapping | |
| SOC 2 | A1.1A1.2CC9.1 | Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure… | Editorial | Same topic: Business Continuity (editorial pick)5 loosely related (not mappings)CC7.5 Recovering from identified security incidents Only shares CSF ID.IM-03, ID.IM-04, RC.CO-04, RC.RP-01…: related, not a mapping A1.3 Testing recovery plan procedures Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-05: related, not a mapping CC2.3 Communication with external parties Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.OC-04: related, not a mapping |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Crosswalk | Same topic: Business Continuity19 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-02, ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping 12.10.3 Incident response staff available around the clock Only shares CSF ID.IM-04, RC.CO-04, RC.RP-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-02, ID.IM-04, RC.RP-02: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.IM-02, RC.RP-05: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Only shares CSF RC.RP-03: related, not a mapping …and 11 more in the downloads |
| CMMC | IR.L2-3.6.1MP.L2-3.8.9PE.L2-3.10.6 | Incident Handling; Protect Backups… | No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04…: related, not a mapping | |
| 800-53 | CP-2(8)CP-7CP-2CP-10 | Identify Critical Assets; Alternate Processing Site… | Crosswalk | Same topic: Business Continuity NIST HIPAA → SP 800-53 crosswalk |
| GDPR | Art.32(1)(b) | Security of processing | Editorial | Same topic: Business Continuity (editorial pick)2 loosely related (not mappings)Art.32(1)(c) Security of processing Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02, RC.RP-03…: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping |
| NIS2 | 4.14.3 | Business continuity and disaster recovery plan; Crisis management | Crosswalk | Same topic: Business Continuity |
| Essential Eight | ISM-1515ISM-1511ISM-1705ISM-1706 | Restoration of data, applications and settings from backups to a common point in time…; Backups of data, applications and settings are performed and retained in accordance…… | No mapping. Only shares CSF RC.RP-02, RC.RP-03, RC.RP-05: related, not a mapping+7 more loosely related (not mappings)ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Only shares CSF RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Only shares CSF RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Only shares CSF RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Only shares CSF RC.RP-03: related, not a mapping …and 3 more in the downloads | |
| DORA | Art.11(1)Art.11(4)Art.11(6) | Response and recovery; Response and recovery… | Editorial | Same topic: Business Continuity (editorial pick)12 loosely related (not mappings)Art.11(3) Response and recovery Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping Art.12(6) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping Art.12(4) Backup policies and procedures, restoration and recovery procedures and methods Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping …and 4 more in the downloads |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.