Workstation Use

frameworkHIPAA Security Rule section§164.310 Physical safeguards csf 2.0DE.CM-02 DE.CM-09 ID.AM-03 PR.AA-03 PR.AA-05 PR.AA-06 PR.DS-10 PR.IR-01 topicsPhysical Security frameworks6 2 0

Official textImplement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.310(b) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Crosswalk	Same topic: Physical Security 6 loosely related (not mappings) DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping PR.AA-03 Users, services, and hardware are authenticated Loosely related Only shares CSF PR.AA-03: related, not a mapping PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Crosswalk	Same topic: Physical Security 31 loosely related (not mappings) A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03, PR.AA-05, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.DS-10: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF ID.AM-03, PR.DS-10, PR.IR-01: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.16 Identity management Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 23 more in the downloads
CIS v8.1	CIS 3.12 CIS 3.3 CIS 3.8 CIS 5.1	Segment Data Processing and Storage Based on Sensitivity; Configure Data Access Control Lists…	Loosely related	No mapping. Only shares CSF PR.DS-10, PR.IR-01, PR.AA-05, ID.AM-03: related, not a mapping +52 more loosely related (not mappings) CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping …and 48 more in the downloads
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick) 10 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03, PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads
PCI DSS	9.2.3 9.3.1.1 9.2.1 9.2.1.1 9.3.1 9.3.2	Physical access to network hardware restricted; Sensitive-area access authorised and revoked promptly…	Crosswalk	Same topic: Physical Security 51 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.CM-09, PR.IR-01: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping 8.2.8 Re-authentication after 15 minutes idle Loosely related Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping 9.2.4 Consoles in sensitive areas locked when unattended Loosely related Only shares CSF PR.AA-03, PR.AA-06: related, not a mapping …and 43 more in the downloads
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Crosswalk	Same topic: Physical Security 51 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-09, PR.AA-05, PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05, PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF DE.CM-09, PR.DS-10, PR.IR-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02, DE.CM-09, PR.AA-05: related, not a mapping AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02, DE.CM-09: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping …and 43 more in the downloads
800-53	PE-2 PE-3 PE-6 PE-8 PE-13 PE-14 AC-3 AC-4 AC-11 AC-12 AC-16 AC-17 AC-19 PE-5 PL-4 PS-6	Physical Access Authorizations; Physical Access Control…	Crosswalk	Same topic: Physical Security NIST HIPAA → SP 800-53 crosswalk 63 loosely related (not mappings) SI-10 Information Input Validation Loosely related Only shares CSF PR.AA-03, PR.DS-10, PR.IR-01: related, not a mapping AC-2 Account Management Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF ID.AM-03, PR.DS-10: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-02, DE.CM-09: related, not a mapping PE-20 Asset Monitoring and Tracking Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF DE.CM-09, PR.DS-10: related, not a mapping …and 55 more in the downloads
GDPR	Art.32(1)(b)Art.5(1)(e)Art.5(1)(f)Art.25(2)	Security of processing; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping +1 more loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping
NIS2	13.1 13.2 13.3	Supporting utilities; Protection against physical and environmental threats…	Crosswalk	Same topic: Physical Security 12 loosely related (not mappings) 11.5 Identification Loosely related Only shares CSF PR.AA-05, PR.AA-06: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-09: related, not a mapping 11.1 Access control policy Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 4 more in the downloads
Essential Eight	ISM-0109 ISM-0445 ISM-0843 ISM-0974	Event logs from workstations are analysed in a timely manner to detect cyber security…; Privileged human users are assigned a dedicated privileged user account to be used……	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.AA-05, PR.AA-03: related, not a mapping +42 more loosely related (not mappings) ISM-1173 Multi-factor authentication is used to authenticate privileged human users of systems Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 38 more in the downloads
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick) 10 loosely related (not mappings) Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03, PR.IR-01: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.AA-03: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-10: related, not a mapping
Cyber Essentials	CE 4 CE 1 CE 2 CE 5	User Access Control; Firewalls…	Loosely related	No mapping. Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01, ID.AM-03…: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.