Unique User Identification

frameworkHIPAA Security Rule section§164.312 Technical safeguards statusRequired csf 2.0DE.CM-01 DE.CM-03 PR.AA-01 PR.AA-03 PR.AA-05 PR.DS-10 PR.IR-01 topicsAccess Control frameworks7 4 0

Official textAssign a unique name and/or number for identifying and tracking user identity.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.312(a)(2)(i) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Crosswalk	Same topic: Access Control 5 loosely related (not mappings) DE.CM-01 Networks and network services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-01: related, not a mapping DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-03: related, not a mapping PR.AA-03 Users, services, and hardware are authenticated Loosely related Only shares CSF PR.AA-03: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3	Access control; Identity management…	Crosswalk	Same topic: Access Control 27 loosely related (not mappings) A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping A.8.5 Secure authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03, PR.AA-05: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.17 Authentication information Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping …and 19 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control 37 loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping CIS 8.6 Collect DNS Query Audit Logs Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping …and 29 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control (editorial pick) 6 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF DE.CM-01, PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-10: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control 52 loosely related (not mappings) 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 8.2.8 Re-authentication after 15 minutes idle Loosely related Only shares CSF PR.AA-03, PR.DS-10: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 2.2.2 Vendor default accounts managed or removed Loosely related Only shares CSF PR.AA-03: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.AA-03: related, not a mapping …and 44 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Authorized Access Control; Transaction & Function Control	Crosswalk	Same topic: Access Control 53 loosely related (not mappings) SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-01, PR.AA-05…: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping AU.L2-3.3.3 Event Review Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 45 more in the downloads
800-53	AC-2 AC-3 IA-2 IA-3 IA-4 IA-8	Account Management; Access Enforcement…	Crosswalk	Same topic: Access Control NIST HIPAA → SP 800-53 crosswalk 55 loosely related (not mappings) SC-7 Boundary Protection Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SI-10 Information Input Validation Loosely related Only shares CSF PR.AA-03, PR.DS-10, PR.IR-01: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping AU-13 Monitoring for Information Disclosure Loosely related Only shares CSF DE.CM-03, PR.DS-10: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping IA-5 Authenticator Management Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA-7 Cryptographic Module Authentication Loosely related Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 47 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 5 loosely related (not mappings) Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF DE.CM-03: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF DE.CM-03: related, not a mapping
NIS2	11.1 11.2 11.5	Access control policy; Management of access rights…	Crosswalk	Same topic: Access Control 7 loosely related (not mappings) 6.7 Network security Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 11.7 Multi-factor authentication Loosely related Only shares CSF PR.AA-03: related, not a mapping 11.4 Administration systems Loosely related Only shares CSF PR.AA-05: related, not a mapping
Essential Eight	ISM-0109 ISM-1906 ISM-1907 ISM-0445	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping +35 more loosely related (not mappings) ISM-0974 Multi-factor authentication is used to authenticate unprivileged human users of systems Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1173 Multi-factor authentication is used to authenticate privileged human users of systems Loosely related Only shares CSF PR.AA-03: related, not a mapping ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 31 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 11 loosely related (not mappings) Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.AA-03: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 3 more in the downloads
CPS 234	Para 21 Para 23	Timely controls commensurate with risk and asset life-cycle; Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) CE 1 Firewalls Loosely related Only shares CSF PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.