Contingency Operations

frameworkHIPAA Security Rule section§164.310 Physical safeguards statusAddressable csf 2.0DE.CM-02 GV.OC-04 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.AA-06 PR.DS-11 PR.IR-02 PR.IR-04 RC.CO-04 RC.RP-03 topics— frameworks1 0 2

Official textEstablish (and implement as needed) procedures that allow facility access in support of the restoration of lost data under the Disaster Recovery Plan and Emergency Mode Operations Plan in the event of an emergency.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.310(a)(2)(i) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 GV.OC-04 PR.AA-06 PR.DS-11	The physical environment is monitored to find potentially adverse events; Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated…	Loosely related	No mapping. Only shares CSF DE.CM-02, GV.OC-04, PR.AA-06, PR.DS-11: related, not a mapping +4 more loosely related (not mappings) PR.IR-02 The organization's technology assets are protected from environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping PR.IR-04 Adequate resource capacity to ensure availability is maintained Loosely related Only shares CSF PR.IR-04: related, not a mapping RC.CO-04 Public updates on incident recovery are shared using approved methods and messaging Loosely related Only shares CSF RC.CO-04: related, not a mapping RC.RP-03 The integrity of backups and other restoration assets is verified before using them for restoration Loosely related Only shares CSF RC.RP-03: related, not a mapping
ISO 27001	A.7.4 A.7.12 A.8.13 A.5.20	Physical security monitoring; Cabling security…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, PR.IR-02, PR.DS-11…: related, not a mapping +14 more loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.7.1 Physical security perimeters Loosely related Only shares CSF PR.AA-06: related, not a mapping A.7.2 Physical entry Loosely related Only shares CSF PR.AA-06: related, not a mapping A.7.3 Securing offices, rooms and facilities Loosely related Only shares CSF PR.AA-06: related, not a mapping …and 10 more in the downloads
CIS v8.1	CIS 11.5 CIS 11.2 CIS 11.3 CIS 17.2	Test Data Recovery; Perform Automated Backups…	Loosely related	No mapping. Only shares CSF PR.DS-11, RC.RP-03, RC.CO-04: related, not a mapping +2 more loosely related (not mappings) CIS 17.6 Define Mechanisms for Communicating During Incident Response Loosely related Only shares CSF RC.CO-04: related, not a mapping CIS 11.4 Establish and Maintain an Isolated Instance of Recovery Data Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping
SOC 2	A1.2 CC6.4 CC7.5 A1.1	Environmental protections, backups and recovery infrastructure; Physical access restrictions…	Loosely related	No mapping. Only shares CSF GV.OC-04, PR.DS-11, RC.RP-03, DE.CM-02…: related, not a mapping +3 more loosely related (not mappings) CC2.3 Communication with external parties Loosely related Only shares CSF RC.CO-04: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04: related, not a mapping
PCI DSS	12.10.1 9.3.1.1 9.4.1.2 9.4.1.1	Incident response plan ready to activate; Sensitive-area access authorised and revoked promptly…	Loosely related	No mapping. Only shares CSF GV.OC-04, ID.IM-04, PR.DS-11, PR.IR-02…: related, not a mapping +14 more loosely related (not mappings) 9.5.1.2 POI devices inspected for tampering Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF ID.IM-04, RC.CO-04: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF RC.RP-03: related, not a mapping 9.1.1 Physical security policies documented and kept current Loosely related Only shares CSF PR.IR-02: related, not a mapping …and 10 more in the downloads
CMMC	CA.L2-3.12.3 CM.L2-3.4.9 IR.L2-3.6.1 MP.L2-3.8.9	Security Control Monitoring; User-Installed Software…	Loosely related	No mapping. Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping +6 more loosely related (not mappings) PE.L2-3.10.2 Monitor Facility Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.3 Escort Visitors Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.4 Physical Access Logs Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.5 Manage Physical Access Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping …and 2 more in the downloads
800-53	CP-2 CP-6 CP-7 PE-2 PE-3 PE-17	Contingency Plan; Alternate Storage Site…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 27 loosely related (not mappings) CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04: related, not a mapping CP-4 Contingency Plan Testing Loosely related Only shares CSF ID.IM-02, RC.RP-03: related, not a mapping CP-9 System Backup Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping PE-6 Monitoring Physical Access Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE-18 Location of System Components Loosely related Only shares CSF PR.AA-06, PR.IR-02: related, not a mapping PE-20 Asset Monitoring and Tracking Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping CP-2(8) Identify Critical Assets Loosely related Only shares CSF GV.OC-04: related, not a mapping …and 19 more in the downloads
GDPR	Art.32(1)(c)Art.32(1)(b)Art.34(1)	Security of processing; Security of processing…	Loosely related	No mapping. Only shares CSF ID.IM-04, PR.DS-11, RC.RP-03, GV.OC-04…: related, not a mapping
NIS2	13.3 3.5 4.1 4.2	Perimeter and physical access control; Incident response…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, RC.CO-04, GV.OC-04…: related, not a mapping +3 more loosely related (not mappings) 11.5 Identification Loosely related Only shares CSF PR.AA-06: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-02: related, not a mapping 13.2 Protection against physical and environmental threats Loosely related Only shares CSF PR.IR-02: related, not a mapping
Essential Eight	ISM-1511 ISM-1515 ISM-1705 ISM-1706	Backups of data, applications and settings are performed and retained in accordance…; Restoration of data, applications and settings from backups to a common point in time……	Loosely related	No mapping. Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping +7 more loosely related (not mappings) ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1811 Backups of data, applications and settings are retained in a secure and resilient manner Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 3 more in the downloads
DORA	Art.6(2)Art.9(4)(c)Art.12(1)Art.12(2)	ICT risk management framework; Protection and prevention…	Loosely related	No mapping. Only shares CSF DE.CM-02, PR.AA-06, PR.IR-02, PR.DS-11…: related, not a mapping +8 more loosely related (not mappings) Art.12(3) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(1) Response and recovery Loosely related Only shares CSF GV.OC-04: related, not a mapping Art.11(2)(e) Response and recovery Loosely related Only shares CSF RC.CO-04: related, not a mapping …and 4 more in the downloads
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.