HIPAA · §164.308 Administrative safeguards
§164.308(b)(4)
Written Contract or Other Arrangement
frameworkHIPAA Security Rule
section§164.308 Administrative safeguards
statusRequired
csf 2.0DE.CM-06 GV.OC-05 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-03 ID.AM-04 ID.AM-08 ID.IM-03 ID.RA-09 PR.DS-01 PR.DS-02 PR.DS-10
topics—
frameworks1 0 0
Official textDocument the satisfactory assurances required by this standard through a written contract or other arrangement with the business associate that meets the applicable requirements of §164.314(a). Readers may find useful resources in Appendix F, including OCR BAA guidance and/or templates that include applicable language.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.OC-05GV.SC-04GV.SC-05 | External service provider activities and services are monitored to find potentially adverse events; Outcomes, capabilities, and services that the organization depends on are understood and communicated… | No mapping. Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-05: related, not a mapping+13 more loosely related (not mappings)GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Only shares CSF GV.SC-09: related, not a mapping …and 9 more in the downloads | |
| ISO 27001 | A.5.19A.5.22A.5.20Clause 4.2 | Information security in supplier relationships; Monitoring, review and change management of supplier services… | No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping+45 more loosely related (not mappings)A.5.3 Segregation of duties Only shares CSF GV.OC-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Only shares CSF ID.AM-08, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.22 Segregation of networks Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 41 more in the downloads | |
| CIS v8.1 | CIS 15.4CIS 15.7CIS 3.5CIS 15.6 | Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers… | No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+34 more loosely related (not mappings)CIS 15.1 Establish and Maintain an Inventory of Service Providers Only shares CSF GV.SC-04, ID.AM-04: related, not a mapping CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping CIS 2.1 Establish and Maintain a Software Inventory Only shares CSF ID.AM-02: related, not a mapping …and 30 more in the downloads | |
| SOC 2 | CC9.2CC6.1C1.2CC6.5 | Managing vendor and business partner risk; Logical access security over information assets… | No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+4 more loosely related (not mappings)CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.OC-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF ID.AM-03: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF PR.DS-02: related, not a mapping | |
| PCI DSS | 12.8.112.8.51.2.412.5.2 | List of third-party service providers kept; Responsibilities split with each provider documented… | No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+54 more loosely related (not mappings)12.8.2 Written agreements with service providers Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.3 Due diligence before engaging service providers Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10…: related, not a mapping …and 50 more in the downloads | |
| CMMC | RA.L2-3.11.1SC.L2-3.13.2SI.L2-3.14.6SI.L2-3.14.7 | Risk Assessments; Security Engineering… | No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping+34 more loosely related (not mappings)CA.L2-3.12.4 System Security Plan Only shares CSF ID.AM-03, ID.AM-08, ID.IM-03: related, not a mapping SC.L2-3.13.1 Boundary Protection Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 30 more in the downloads | |
| 800-53 | CA-3SA-4SA-9 | Information Exchange; Acquisition Process… | Crosswalk | NIST HIPAA → SP 800-53 crosswalk71 loosely related (not mappings)SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SR-6 Supplier Assessments and Reviews Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SI-4 System Monitoring Only shares CSF DE.CM-06, ID.IM-03, PR.DS-01, PR.DS-02…: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping SI-7 Software, Firmware, and Information Integrity Only shares CSF ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping PL-2 System Security and Privacy Plans Only shares CSF ID.AM-03, ID.AM-08, ID.IM-03: related, not a mapping …and 63 more in the downloads |
| GDPR | Art.28(1)Art.28(3)Art.5(1)(e)Art.5(1)(f) | Processor; Processor… | No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+4 more loosely related (not mappings)Art.30(1) Records of processing activities Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.32(1)(b) Security of processing Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| NIS2 | 5.112.45.26.1 | Supply chain security policy; Asset inventory… | No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+7 more loosely related (not mappings)…and 3 more in the downloads | |
| Essential Eight | ISM-1807ISM-1488 | An automated method of asset discovery is used at least fortnightly to support the…; Microsoft Office macros in files originating from the internet are blocked | No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08, PR.DS-02: related, not a mapping | |
| DORA | Art.28(8)Art.30(2)Art.8(1)Art.28(3) | General principles; Key contractual provisions… | No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping+15 more loosely related (not mappings)Art.28(4) General principles Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.28(5) General principles Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping …and 11 more in the downloads | |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+2 more loosely related (not mappings)Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 3CE 1CE 4 | Security Update Management; Firewalls… | No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08, ID.AM-03: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.