Maintenance Records

frameworkHIPAA Security Rule section§164.310 Physical safeguards statusAddressable csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 topics— frameworks1 0 0

Official textImplement policies and procedures to document repairs and modifications to the physical components of a facility that are related to security (e.g., hardware, walls, doors, and locks).45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.310(a)(2)(iv) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02: related, not a mapping +2 more loosely related (not mappings) GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Loosely related Only shares CSF ID.AM-08: related, not a mapping
ISO 27001	A.5.1 A.5.19 A.5.20 A.5.31	Policies for information security; Information security in supplier relationships…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping +27 more loosely related (not mappings) Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping A.5.5 Contact with authorities Loosely related Only shares CSF GV.OV-01: related, not a mapping A.5.6 Contact with special interest groups Loosely related Only shares CSF GV.OV-01: related, not a mapping …and 23 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 1.2 CIS 1.3	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +5 more loosely related (not mappings) CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads
SOC 2	CC1.1 CC5.3 CC4.1 CC4.2	Commitment to integrity and ethical values; Control activities deployed through policies and procedures…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03: related, not a mapping +2 more loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	12.3.4 6.2.3 6.3.1 6.3.3	Hardware and software technologies reviewed annually; Custom code reviewed before release…	Loosely related	No mapping. Only shares CSF GV.SC-03, ID.AM-08, ID.IM-01, ID.IM-03: related, not a mapping +40 more loosely related (not mappings) 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping …and 36 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.1 CA.L2-3.12.4 SC.L2-3.13.2	Risk Assessments; Security Control Assessment…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping +2 more loosely related (not mappings) MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	MA-1 MA-2 MA-6	Policy and Procedures; Controlled Maintenance…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 43 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 35 more in the downloads
GDPR	Art.24(2)Art.5(2)Art.28(1)Art.30(1)	Responsibility of the controller; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03, GV.SC-03…: related, not a mapping
NIS2	1.1 5.1 6.1 6.2	Policy on the security of network and information systems; Supply chain security policy…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, ID.AM-08: related, not a mapping +3 more loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)Art.5(2)(f)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03: related, not a mapping +8 more loosely related (not mappings) Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 4 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 20	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03, ID.AM-08: related, not a mapping +4 more loosely related (not mappings) Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.