Contingency Plan

frameworkHIPAA Security Rule section§164.308 Administrative safeguards csf 2.0GV.OC-03 GV.OC-04 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 GV.SC-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.IR-02 RC.CO-04 RC.RP-03 topicsRecovery Planning frameworks5 4 1

Official textEstablish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(7) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RC.RP-01 RC.RP-02	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The recovery portion of the incident response plan is executed once initiated from the incident response process…	Crosswalk	Same topic: Recovery Planning 10 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Loosely related Only shares CSF GV.OC-04: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping PR.IR-02 The organization's technology assets are protected from environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping …and 2 more in the downloads
ISO 27001	A.5.29 A.5.30	Information security during disruption; ICT readiness for business continuity	Crosswalk	Same topic: Recovery Planning 33 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.OC-04, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.OC-04, GV.PO-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, ID.IM-03, ID.IM-04: related, not a mapping A.5.24 Information security incident management planning and preparation Loosely related Only shares CSF GV.OV-01, ID.IM-04: related, not a mapping A.5.26 Response to information security incidents Loosely related Only shares CSF GV.SC-08, ID.IM-04: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03, GV.OC-04: related, not a mapping …and 25 more in the downloads
CIS v8.1	CIS 11.1	Establish and Maintain a Data Recovery Process	Editorial	Same topic: Recovery Planning (editorial pick) 5 loosely related (not mappings) CIS 11.5 Test Data Recovery Loosely related Only shares CSF RC.RP-03: related, not a mapping CIS 15.4 Ensure Service Provider Contracts Include Security Requirements Loosely related Only shares CSF GV.SC-08: related, not a mapping CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RC.CO-04: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Loosely related Only shares CSF RC.CO-04: related, not a mapping CIS 11.4 Establish and Maintain an Isolated Instance of Recovery Data Loosely related Only shares CSF RC.RP-03: related, not a mapping
SOC 2	A1.3 CC7.5	Testing recovery plan procedures; Recovering from identified security incidents	Editorial	Same topic: Recovery Planning (editorial pick) 11 loosely related (not mappings) A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04, RC.RP-03: related, not a mapping CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping CC2.3 Communication with external parties Loosely related Only shares CSF RC.CO-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 3 more in the downloads
PCI DSS	12.10.1	Incident response plan ready to activate	Crosswalk	Same topic: Recovery Planning 53 loosely related (not mappings) 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, ID.IM-04: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, ID.IM-04: related, not a mapping 9.1.1 Physical security policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.IR-02: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-01, ID.IM-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-03, ID.IM-01: related, not a mapping …and 45 more in the downloads
CMMC	IR.L2-3.6.1 RA.L2-3.11.1 CA.L2-3.12.1 IR.L2-3.6.2	Incident Handling; Risk Assessments…	Loosely related	No mapping. Only shares CSF GV.SC-08, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping +2 more loosely related (not mappings) MP.L2-3.8.9 Protect Backups Loosely related Only shares CSF RC.RP-03: related, not a mapping PE.L2-3.10.6 Alternative Work Sites Loosely related Only shares CSF PR.IR-02: related, not a mapping
800-53	CP-2 CP-10 CP-1	Contingency Plan; System Recovery and Reconstitution…	Crosswalk	Same topic: Recovery Planning NIST HIPAA → SP 800-53 crosswalk 50 loosely related (not mappings) IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 42 more in the downloads
GDPR	Art.32(1)(c)	Security of processing	Editorial	Same topic: Recovery Planning (editorial pick) 5 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.CO-04: related, not a mapping
NIS2	4.1	Business continuity and disaster recovery plan	Crosswalk	Same topic: Recovery Planning 8 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 3.5 Incident response Loosely related Only shares CSF RC.CO-04: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 13.2 Protection against physical and environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-1511 ISM-1515 ISM-1705 ISM-1706	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Loosely related	No mapping. Only shares CSF RC.RP-03: related, not a mapping +7 more loosely related (not mappings) ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Loosely related Only shares CSF RC.RP-03: related, not a mapping …and 3 more in the downloads
DORA	Art.11(3)Art.12(6)	Response and recovery; Backup policies and procedures, restoration and recovery procedures and methods	Editorial	Same topic: Recovery Planning (editorial pick) 21 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(2) ICT risk management framework Loosely related Only shares CSF PR.IR-02: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 13 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 22	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping +3 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.