Business Associate Contracts and Other Arrangements

frameworkHIPAA Security Rule section§164.308 Administrative safeguards csf 2.0DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-03 ID.AM-04 PR.DS-01 PR.DS-02 PR.DS-10 topicsCloud Security, Vendor Risk Mgmt frameworks7 5 0

Official textA covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity’s behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(b)(1) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security 11 loosely related (not mappings) GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Loosely related Only shares CSF ID.AM-02: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 3 more in the downloads
ISO 27001	A.5.19 A.5.20 A.5.22 A.5.23	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security 48 loosely related (not mappings) Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.SC-05, GV.SC-06, PR.DS-01, PR.DS-02…: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF GV.OC-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.RR-04, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.RR-04, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping …and 40 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 33 loosely related (not mappings) CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-03: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 6.1 Establish an Access Granting Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 6.2 Establish an Access Revoking Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 25 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 7 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02, ID.AM-04, PR.DS-01, PR.DS-02: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt 51 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10…: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping 12.9.2 Service providers support customer compliance requests Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF GV.SC-10, PR.DS-10: related, not a mapping …and 43 more in the downloads
CMMC	AC.L2-3.1.20	External Connections	Crosswalk	Same topic: Cloud Security 38 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-06, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 30 more in the downloads
800-53	AC-20 SA-4 SA-9 SR-6 CA-3 PS-7	Use of External Systems; Acquisition Process…	Crosswalk	Same topic: Cloud Security, Vendor Risk Mgmt NIST HIPAA → SP 800-53 crosswalk 56 loosely related (not mappings) SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-06, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 48 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 8 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt, Cloud Security 10 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-02, ID.AM-03, ID.AM-04: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 2 more in the downloads
Essential Eight	ISM-1807 ISM-1488	An automated method of asset discovery is used at least fortnightly to support the…; Microsoft Office macros in files originating from the internet are blocked	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, PR.DS-02: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 14 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 6 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 2 loosely related (not mappings) CE 3 Security Update Management Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CE 1 Firewalls Loosely related Only shares CSF ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.