Evaluation

frameworkHIPAA Security Rule section§164.308 Administrative safeguards csf 2.0DE.AE-02 DE.AE-03 DE.CM-01 DE.CM-02 DE.CM-03 DE.CM-06 DE.CM-09 GV.OC-03 GV.OV-01 GV.OV-03 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-07 topicsCompliance, Vulnerability Mgmt frameworks7 6 0

Official textPerform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity’s or business associate’s security policies and procedures meet the requirements of this subpart.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(8) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-01 ID.RA-08 GV.OC-03 GV.OV-03	Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance 12 loosely related (not mappings) DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Loosely related Only shares CSF DE.AE-02: related, not a mapping DE.AE-03 Information is correlated from multiple sources Loosely related Only shares CSF DE.AE-03: related, not a mapping DE.CM-01 Networks and network services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-01: related, not a mapping DE.CM-02 The physical environment is monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-02: related, not a mapping DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-03: related, not a mapping DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-06: related, not a mapping DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping …and 4 more in the downloads
ISO 27001	A.8.8 A.5.31 A.5.36 Clause 9.1	Management of technical vulnerabilities; Legal, statutory, regulatory and contractual requirements…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance 31 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.PO-01, GV.PO-02…: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-06…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.SC-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.OV-03, GV.SC-03: related, not a mapping A.5.24 Information security incident management planning and preparation Loosely related Only shares CSF DE.AE-02, GV.OV-01: related, not a mapping A.7.4 Physical security monitoring Loosely related Only shares CSF DE.CM-02, DE.CM-03: related, not a mapping A.8.15 Logging Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping A.8.32 Change management Loosely related Only shares CSF GV.OV-03, ID.RA-07: related, not a mapping …and 23 more in the downloads
CIS v8.1	CIS 7.1 CIS 7.2 CIS 7.5 CIS 7.6 CIS 7.7 CIS 16.6 CIS 18.1 CIS 18.2 CIS 18.3 CIS 18.4 CIS 18.5	Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process…	Crosswalk	Same topic: Vulnerability Mgmt 40 loosely related (not mappings) CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping CIS 8.11 Conduct Audit Log Reviews Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 13.6 Collect Network Traffic Flow Logs Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping CIS 13.2 Deploy a Host-Based Intrusion Detection Solution Loosely related Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping …and 32 more in the downloads
SOC 2	CC4.1 CC4.2 CC7.1	Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies…	Editorial	Same topic: Compliance, Vulnerability Mgmt (editorial pick) 8 loosely related (not mappings) CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF DE.CM-06, GV.SC-03: related, not a mapping CC6.4 Physical access restrictions Loosely related Only shares CSF DE.CM-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF DE.AE-03: related, not a mapping
PCI DSS	6.3.1 11.3.1 11.3.2 12.4.2	Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance 68 loosely related (not mappings) 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-01, GV.OV-03, ID.IM-01, ID.RA-07: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, GV.OV-03, ID.IM-03: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF GV.OV-03, ID.IM-02, ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.OV-03, GV.SC-03, ID.IM-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF DE.CM-06, GV.OC-03, ID.IM-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.AE-03, DE.CM-01: related, not a mapping …and 60 more in the downloads
CMMC	RA.L2-3.11.2 RA.L2-3.11.3 CA.L2-3.12.1	Vulnerability Scan; Vulnerability Remediation…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance 32 loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-02…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.OV-03, GV.SC-03, ID.IM-01…: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping AU.L2-3.3.3 Event Review Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping …and 24 more in the downloads
800-53	CA-8 RA-5 CA-2 PM-4 PM-6 CA-1 CA-6 CA-7	Penetration Testing; Vulnerability Monitoring and Scanning…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance NIST HIPAA → SP 800-53 crosswalk 67 loosely related (not mappings) SI-4 System Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-06…: related, not a mapping AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 59 more in the downloads
GDPR	Art.5(2)Art.32(1)(d)	Principles relating to processing of personal data; Security of processing	Editorial	Same topic: Compliance, Vulnerability Mgmt (editorial pick) 5 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF DE.CM-06, GV.SC-03: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF DE.CM-06: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF DE.CM-03: related, not a mapping
NIS2	6.5 6.10 2.2 2.3	Security testing; Vulnerability handling and disclosure…	Crosswalk	Same topic: Vulnerability Mgmt, Compliance 11 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-02, DE.CM-06, GV.OC-03: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping 2.1 Risk management framework Loosely related Only shares CSF ID.RA-01: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.4 Change management, repairs and maintenance Loosely related Only shares CSF ID.RA-07: related, not a mapping …and 3 more in the downloads
Essential Eight	ISM-1698 ISM-1699 ISM-1701 ISM-1702 ISM-1807 ISM-1808	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates……	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 38 loosely related (not mappings) ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01, DE.CM-03…: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-09: related, not a mapping ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-0843 Application control is implemented on workstations Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 30 more in the downloads
DORA	Art.5(2)(f)Art.6(6)Art.6(7)Art.8(2)Art.25(1)Art.26(1)Art.27(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Compliance, Vulnerability Mgmt (editorial pick) 18 loosely related (not mappings) Art.10(3) Detection Loosely related Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.AE-02, DE.AE-03, DE.CM-01: related, not a mapping Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(2) ICT risk management framework Loosely related Only shares CSF DE.CM-02: related, not a mapping …and 10 more in the downloads
CPS 234	Para 17 Para 27 Para 30 Para 32 Para 33 Para 34	Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness…	Editorial	Same topic: Vulnerability Mgmt, Compliance (editorial pick) 6 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF DE.CM-06, GV.SC-03: related, not a mapping Para 18 Maintain an information security policy framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 19 Policies direct everyone with security obligations Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF DE.CM-06, GV.SC-03: related, not a mapping Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF DE.CM-06: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Vulnerability Mgmt (editorial pick) 1 loosely related (not mappings) CE 5 Malware protection Loosely related Only shares CSF DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.