HIPAA · §164.312 Technical safeguards
§164.312(a)(2)(ii)
Emergency Access Procedure
frameworkHIPAA Security Rule
section§164.312 Technical safeguards
statusRequired
csf 2.0DE.CM-01 DE.CM-03 GV.OC-04 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.AA-01 PR.AA-05 PR.DS-10 PR.IR-01 PR.IR-02 RC.CO-04 RC.RP-03
topics—
frameworks1 0 0
Official textEstablish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-01DE.CM-03GV.OC-04PR.AA-01 | Networks and network services are monitored to find potentially adverse events; Personnel activity and technology usage are monitored to find potentially adverse events… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, GV.OC-04, PR.AA-01: related, not a mapping+6 more loosely related (not mappings)PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties Only shares CSF PR.AA-05: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Only shares CSF PR.IR-01: related, not a mapping PR.IR-02 The organization's technology assets are protected from environmental threats Only shares CSF PR.IR-02: related, not a mapping …and 2 more in the downloads | |
| ISO 27001 | A.5.15A.8.2Clause 9.1A.5.3 | Access control; Privileged access rights… | No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-03…: related, not a mapping+39 more loosely related (not mappings)…and 35 more in the downloads | |
| CIS v8.1 | CIS 3.12CIS 5.1CIS 3.3CIS 5.6 | Segment Data Processing and Storage Based on Sensitivity; Establish and Maintain an Inventory of Accounts… | No mapping. Only shares CSF PR.DS-10, PR.IR-01, PR.AA-01, PR.AA-05: related, not a mapping+46 more loosely related (not mappings)CIS 6.8 Define and Maintain Role-Based Access Control Only shares CSF PR.AA-05: related, not a mapping …and 42 more in the downloads | |
| SOC 2 | CC6.6CC7.5A1.2CC6.1 | Protection against threats from outside system boundaries; Recovering from identified security incidents… | No mapping. Only shares CSF DE.CM-01, PR.AA-05, PR.IR-01, ID.IM-03…: related, not a mapping+12 more loosely related (not mappings)CC6.2 User registration, authorization and removal Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC7.2 Monitoring system components for anomalies Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping …and 8 more in the downloads | |
| PCI DSS | 12.10.110.2.11.2.47.2.2 | Incident response plan ready to activate; Audit logs enabled and active… | No mapping. Only shares CSF GV.OC-04, ID.IM-04, PR.IR-02, RC.CO-04…: related, not a mapping+49 more loosely related (not mappings)10.4.1 Security event and critical logs reviewed daily Only shares CSF DE.CM-01, DE.CM-03: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 12.5.1 Inventory of in-scope system components Only shares CSF GV.OC-04, PR.AA-01: related, not a mapping 12.10.3 Incident response staff available around the clock Only shares CSF ID.IM-04, RC.CO-04: related, not a mapping …and 45 more in the downloads | |
| CMMC | CM.L2-3.4.9SC.L2-3.13.2SC.L2-3.13.3AC.L2-3.1.1 | User-Installed Software; Security Engineering… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping+51 more loosely related (not mappings)CA.L2-3.12.3 Security Control Monitoring Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping IR.L2-3.6.1 Incident Handling Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04: related, not a mapping …and 47 more in the downloads | |
| 800-53 | AC-2AC-3CP-2 | Account Management; Access Enforcement… | Crosswalk | NIST HIPAA → SP 800-53 crosswalk72 loosely related (not mappings)CA-7 Continuous Monitoring Only shares CSF DE.CM-01, DE.CM-03, ID.IM-01, ID.IM-02…: related, not a mapping SI-4 System Monitoring Only shares CSF DE.CM-01, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping IR-4 Incident Handling Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.CO-04: related, not a mapping SA-8 Security and Privacy Engineering Principles Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping AU-13 Monitoring for Information Disclosure Only shares CSF DE.CM-03, PR.DS-10: related, not a mapping …and 64 more in the downloads |
| GDPR | Art.32(1)(b)Art.25(2)Art.32(1)(c)Art.5(1)(e) | Security of processing; Data protection by design and by default… | No mapping. Only shares CSF GV.OC-04, PR.AA-01, PR.AA-05, PR.DS-10…: related, not a mapping+5 more loosely related (not mappings)Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-10: related, not a mapping Art.29 Processing under the authority of the controller or processor Only shares CSF DE.CM-03: related, not a mapping …and 1 more in the downloads | |
| NIS2 | 6.711.53.54.1 | Network security; Identification… | No mapping. Only shares CSF DE.CM-01, PR.IR-01, PR.AA-01, PR.AA-05…: related, not a mapping+8 more loosely related (not mappings)6.9 Protection against malicious and unauthorised software Only shares CSF DE.CM-01: related, not a mapping …and 4 more in the downloads | |
| Essential Eight | ISM-0109ISM-1906ISM-1907ISM-0445 | Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber…… | No mapping. Only shares CSF DE.CM-01, DE.CM-03, PR.AA-05: related, not a mapping+30 more loosely related (not mappings)ISM-1175 Privileged user accounts (excluding those explicitly authorised to access online… Only shares CSF PR.AA-05: related, not a mapping ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Only shares CSF PR.AA-05: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Only shares CSF PR.AA-05: related, not a mapping …and 26 more in the downloads | |
| DORA | Art.9(4)(c)Art.9(1)Art.10(3)Art.6(2) | Protection and prevention; Protection and prevention… | No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.IR-02, DE.CM-01…: related, not a mapping+18 more loosely related (not mappings)…and 14 more in the downloads | |
| CPS 234 | Para 23Para 21 | Detect and respond to incidents in a timely manner; Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF DE.CM-01, ID.IM-04, PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 4CE 1CE 2 | User Access Control; Firewalls… | No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.IR-01: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.