Applications and Data Criticality Analysis

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusAddressable csf 2.0GV.OC-04 ID.AM-05 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 ID.RA-04 ID.RA-05 PR.IR-02 RC.CO-04 RC.RP-03 topics— frameworks1 0 1

Official textAssess the relative criticality of specific applications and data in support of other Contingency Plan components.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(7)(ii)(E) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-04 ID.AM-05 ID.RA-04 ID.RA-05	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Assets are prioritized based on classification, criticality, resources, and impact on the mission…	Loosely related	No mapping. Only shares CSF GV.OC-04, ID.AM-05, ID.RA-04, ID.RA-05: related, not a mapping +3 more loosely related (not mappings) PR.IR-02 The organization's technology assets are protected from environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging Loosely related Only shares CSF RC.CO-04: related, not a mapping RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration Loosely related Only shares CSF RC.RP-03: related, not a mapping
ISO 27001	Clause 6.1.1 Clause 6.1.2 Clause 6.1.3 A.5.7	General; Information security risk assessment…	Loosely related	No mapping. Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping +16 more loosely related (not mappings) A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-05: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-05: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-05: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 12 more in the downloads
CIS v8.1	CIS 3.7 CIS 11.5 CIS 17.2 CIS 17.6	Establish and Maintain a Data Classification Scheme; Test Data Recovery…	Loosely related	No mapping. Only shares CSF ID.AM-05, RC.RP-03, RC.CO-04: related, not a mapping +2 more loosely related (not mappings) CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-05: related, not a mapping CIS 11.4 Establish and Maintain an Isolated Instance of Recovery Data Loosely related Only shares CSF RC.RP-03: related, not a mapping
SOC 2	CC7.5 A1.2 CC3.2 CC3.3	Recovering from identified security incidents; Environmental protections, backups and recovery infrastructure…	Loosely related	No mapping. Only shares CSF ID.IM-03, ID.IM-04, RC.CO-04, GV.OC-04…: related, not a mapping +7 more loosely related (not mappings) CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-05: related, not a mapping CC2.3 Communication with external parties Loosely related Only shares CSF RC.CO-04: related, not a mapping …and 3 more in the downloads
PCI DSS	12.10.1 12.3.1 6.3.1 6.3.3	Incident response plan ready to activate; Targeted risk analysis for flexible-frequency requirements…	Loosely related	No mapping. Only shares CSF GV.OC-04, ID.IM-04, PR.IR-02, RC.CO-04…: related, not a mapping +17 more loosely related (not mappings) 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF ID.IM-04, RC.CO-04: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping 9.1.1 Physical security policies documented and kept current Loosely related Only shares CSF PR.IR-02: related, not a mapping 9.1.2 Roles for physical security assigned Loosely related Only shares CSF PR.IR-02: related, not a mapping …and 13 more in the downloads
CMMC	RA.L2-3.11.1 IR.L2-3.6.1 MP.L2-3.8.9 MP.L2-3.8.4	Risk Assessments; Incident Handling…	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-04…: related, not a mapping +1 more loosely related (not mappings) PE.L2-3.10.6 Alternative Work Sites Loosely related Only shares CSF PR.IR-02: related, not a mapping
800-53	CP-2 CP-2(8)RA-2	Contingency Plan; Identify Critical Assets…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 22 loosely related (not mappings) RA-3 Risk Assessment Loosely related Only shares CSF ID.AM-05, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-05: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.OC-04, ID.AM-05, ID.RA-04: related, not a mapping CP-4 Contingency Plan Testing Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF GV.OC-04, ID.RA-04: related, not a mapping CP-9 System Backup Loosely related Only shares CSF RC.RP-03: related, not a mapping PE-9 Power Equipment and Cabling Loosely related Only shares CSF PR.IR-02: related, not a mapping …and 14 more in the downloads
GDPR	Art.32(1)(c)Art.35(1)Art.35(7)Art.32(1)(b)	Security of processing; Data protection impact assessment…	Loosely related	No mapping. Only shares CSF ID.IM-04, RC.RP-03, ID.RA-04, ID.RA-05…: related, not a mapping +1 more loosely related (not mappings) Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.CO-04: related, not a mapping
NIS2	2.1 6.10 3.5 4.1	Risk management framework; Vulnerability handling and disclosure…	Loosely related	No mapping. Only shares CSF ID.RA-04, ID.RA-05, RC.CO-04, GV.OC-04: related, not a mapping +2 more loosely related (not mappings) 12.1 Asset classification Loosely related Only shares CSF ID.AM-05: related, not a mapping 13.2 Protection against physical and environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping
Essential Eight	ISM-1511 ISM-1515 ISM-1705 ISM-1706	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping +7 more loosely related (not mappings) ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Loosely related Only shares CSF RC.RP-03: related, not a mapping …and 3 more in the downloads
DORA	Art.8(1)Art.8(2)Art.8(3)Art.8(7)	Identification; Identification…	Loosely related	No mapping. Only shares CSF GV.OC-04, ID.AM-05, ID.RA-04, ID.RA-05: related, not a mapping +11 more loosely related (not mappings) Art.6(2) ICT risk management framework Loosely related Only shares CSF PR.IR-02: related, not a mapping Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.IR-02: related, not a mapping Art.11(1) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.CO-04: related, not a mapping …and 7 more in the downloads
CPS 234	Para 17 Para 21 Para 20	Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle…	Loosely related	No mapping. Only shares CSF ID.RA-04, ID.RA-05, ID.AM-05: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.