Facility Security Plan

frameworkHIPAA Security Rule section§164.310 Physical safeguards statusAddressable csf 2.0DE.CM-02 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.AA-06 PR.IR-02 topicsPhysical Security frameworks1 7 0

Official textImplement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.310(a)(2)(ii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Editorial	Same topic: Physical Security (editorial pick) 7 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Editorial	Same topic: Physical Security (editorial pick) 36 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.AM-08, ID.IM-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, ID.IM-03, ID.IM-04: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.24 Information security incident management planning and preparation Loosely related Only shares CSF GV.OV-01, ID.IM-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping A.7.13 Equipment maintenance Loosely related Only shares CSF ID.AM-08, PR.IR-02: related, not a mapping A.7.14 Secure disposal or re-use of equipment Loosely related Only shares CSF ID.AM-08, PR.IR-02: related, not a mapping …and 28 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 3.8 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping +13 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick) 7 loosely related (not mappings) CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	9.2.1 9.2.1.1 9.2.3 9.3.1 9.3.1.1 9.3.2	Facility entry controls restrict CDE access; Access to sensitive areas monitored by camera or access control…	Editorial	Same topic: Physical Security (editorial pick) 55 loosely related (not mappings) 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-03, ID.AM-08, ID.IM-01: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF GV.OV-01, ID.IM-02, ID.IM-04: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF GV.OV-01, ID.IM-02, ID.IM-04: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping 9.1.1 Physical security policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.IR-02: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping …and 47 more in the downloads
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Editorial	Same topic: Physical Security (editorial pick) 8 loosely related (not mappings) CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	PE-2 PE-3 PE-6 PE-8 PE-13 PE-14 PE-1 PL-2	Physical Access Authorizations; Physical Access Control…	Crosswalk	Same topic: Physical Security (editorial pick) NIST HIPAA → SP 800-53 crosswalk 62 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 54 more in the downloads
GDPR	Art.24(2)Art.5(2)Art.28(1)Art.30(1)	Responsibility of the controller; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03, GV.SC-03…: related, not a mapping
NIS2	13.1 13.2 13.3	Supporting utilities; Protection against physical and environmental threats…	Editorial	Same topic: Physical Security (editorial pick) 8 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-06: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick) 13 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 20	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03, ID.AM-08: related, not a mapping +4 more loosely related (not mappings) Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 1 CE 3	Firewalls; Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.