Access Control

frameworkHIPAA Security Rule section§164.312 Technical safeguards csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-01 PR.AA-05 PR.DS-10 PR.IR-01 topicsAccess Control frameworks7 4 0

Official textImplement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.312(a) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AA-01 PR.AA-05	Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	Crosswalk	Same topic: Access Control 7 loosely related (not mappings) GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3	Access control; Identity management…	Crosswalk	Same topic: Access Control 38 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10: related, not a mapping Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02, PR.DS-10: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping …and 30 more in the downloads
CIS v8.1	CIS 3.3 CIS 5.1 CIS 5.6 CIS 6.7 CIS 6.8 CIS 5.2 CIS 5.3 CIS 5.5 CIS 6.1 CIS 6.2 CIS 6.6 CIS 12.5	Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts…	Crosswalk	Same topic: Access Control 27 loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping CIS 12.2 Establish and Maintain a Secure Network Architecture Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Loosely related Only shares CSF PR.AA-05, PR.IR-01: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Loosely related Only shares CSF PR.AA-05, PR.IR-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 19 more in the downloads
SOC 2	CC6.1 CC6.2 CC6.3	Logical access security over information assets; User registration, authorization and removal…	Editorial	Same topic: Access Control (editorial pick) 9 loosely related (not mappings) CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.AA-05, PR.IR-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, PR.IR-01: related, not a mapping C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-10: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Access control model defined; Access assigned by job function and least privilege…	Crosswalk	Same topic: Access Control 67 loosely related (not mappings) 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF GV.OC-03, PR.DS-10: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-03, PR.IR-01: related, not a mapping 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping 12.1.2 Security policy reviewed at least annually Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping 12.1.3 Security roles and responsibilities defined Loosely related Only shares CSF GV.PO-01, PR.AA-05: related, not a mapping …and 59 more in the downloads
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Authorized Access Control; Transaction & Function Control	Crosswalk	Same topic: Access Control 47 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.AA-05: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05, PR.DS-10, PR.IR-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-10: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping …and 39 more in the downloads
800-53	AC-2 AC-3 AC-1 AC-5 AC-6	Account Management; Access Enforcement…	Crosswalk	Same topic: Access Control NIST HIPAA → SP 800-53 crosswalk 76 loosely related (not mappings) IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 68 more in the downloads
GDPR	Art.25(2)Art.32(1)(b)	Data protection by design and by default; Security of processing	Editorial	Same topic: Access Control (editorial pick) 5 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, PR.IR-01: related, not a mapping Art.5(1)(e) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping
NIS2	11.1 11.2 11.5	Access control policy; Management of access rights…	Crosswalk	Same topic: Access Control 9 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +16 more loosely related (not mappings) ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1647 Privileged access to systems and their resources are disabled after 12 months unless… Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads
DORA	Art.9(4)(c)	Protection and prevention	Editorial	Same topic: Access Control (editorial pick) 15 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-10: related, not a mapping …and 7 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 21	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03, PR.DS-10: related, not a mapping +4 more loosely related (not mappings) Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Access Control (editorial pick) 2 loosely related (not mappings) CE 1 Firewalls Loosely related Only shares CSF PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.