Device and Media Controls

frameworkHIPAA Security Rule section§164.310 Physical safeguards csf 2.0DE.CM-02 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.AM-01 ID.AM-02 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-05 PR.AA-06 PR.PS-01 topicsAsset Management, Mobile Security frameworks7 6 0

Official textImplement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.310(d) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 PR.AA-05 PR.PS-01	Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained…	Crosswalk	Same topic: Asset Management, Mobile Security 7 loosely related (not mappings) DE.CM-02 The physical environment is monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk Loosely related Only shares CSF PR.AA-06: related, not a mapping
ISO 27001	A.5.9 A.5.11 A.7.14 A.6.7 A.8.1	Inventory of information and other associated assets; Return of assets…	Crosswalk	Same topic: Asset Management, Mobile Security 40 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping A.7.4 Physical security monitoring Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping Clause 9.3 Management review Loosely related Only shares CSF ID.IM-02, PR.PS-01: related, not a mapping …and 32 more in the downloads
CIS v8.1	CIS 1.1 CIS 2.1 CIS 1.2 CIS 1.3 CIS 1.4 CIS 1.5 CIS 2.3 CIS 2.4 CIS 4.10 CIS 4.11 CIS 4.12 CIS 16.4	Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Software Inventory…	Crosswalk	Same topic: Asset Management, Mobile Security 21 loosely related (not mappings) CIS 4.1 Establish and Maintain a Secure Configuration Process Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 3.3 Configure Data Access Control Lists Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 4.3 Configure Automatic Session Locking on Enterprise Assets Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.6 Securely Manage Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.7 Manage Default Accounts on Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 5.1 Establish and Maintain an Inventory of Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 13 more in the downloads
SOC 2	CC6.1 CC6.7	Logical access security over information assets; Restricting transmission, movement and removal of information	Editorial	Same topic: Asset Management, Mobile Security (editorial pick) 11 loosely related (not mappings) CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC6.4 Physical access restrictions Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, PR.PS-01: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 3 more in the downloads
PCI DSS	6.3.2 12.5.1	Inventory of custom software and its components; Inventory of in-scope system components	Crosswalk	Same topic: Asset Management 56 loosely related (not mappings) 9.5.1.2 POI devices inspected for tampering Loosely related Only shares CSF DE.CM-02, ID.AM-01, PR.AA-06: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-03, ID.AM-02: related, not a mapping 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping …and 48 more in the downloads
CMMC	CM.L2-3.4.1 AC.L2-3.1.18 AC.L2-3.1.19	System Baselining; Mobile Device Connection…	Crosswalk	Same topic: Asset Management, Mobile Security 36 loosely related (not mappings) CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping PE.L2-3.10.2 Monitor Facility Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.3 Escort Visitors Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.4 Physical Access Logs Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping PE.L2-3.10.5 Manage Physical Access Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping …and 28 more in the downloads
800-53	CM-8 PM-5 AC-19 AC-19(5)MP-1 MP-2 MP-3 MP-4 MP-5 MP-6 PE-16 PE-20	System Component Inventory; System Inventory…	Crosswalk	Same topic: Asset Management, Mobile Security NIST HIPAA → SP 800-53 crosswalk 63 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 55 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Editorial	Same topic: Asset Management (editorial pick) 5 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, PR.PS-01: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.25(2) Data protection by design and by default Loosely related Only shares CSF PR.AA-05: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.AA-05: related, not a mapping
NIS2	12.4	Asset inventory	Crosswalk	Same topic: Asset Management 12 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 11.5 Identification Loosely related Only shares CSF PR.AA-05, PR.AA-06: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-02, GV.OC-03: related, not a mapping 13.3 Perimeter and physical access control Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 4 more in the downloads
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Editorial	Same topic: Asset Management (editorial pick) 51 loosely related (not mappings) ISM-0445 Privileged human users are assigned a dedicated privileged user account to be used… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1412 Web browsers are hardened using ASD and vendor hardening guidance, with the most… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1485 Web browsers do not process web advertisements from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 43 more in the downloads
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Editorial	Same topic: Asset Management (editorial pick) 13 loosely related (not mappings) Art.9(4)(c) Protection and prevention Loosely related Only shares CSF DE.CM-02, PR.AA-05, PR.AA-06: related, not a mapping Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(2) ICT risk management framework Loosely related Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 5 more in the downloads
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Editorial	Same topic: Asset Management (editorial pick) 7 loosely related (not mappings) Para 18 Maintain an information security policy framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 19 Policies direct everyone with security obligations Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 2 CE 3	Secure Configuration; Security Update Management	Editorial	Same topic: Mobile Security, Asset Management (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.