Audit Controls

frameworkHIPAA Security Rule section§164.312 Technical safeguards csf 2.0DE.AE-02 DE.AE-03 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 PR.PS-04 RS.AN-03 RS.AN-06 RS.AN-07 topicsLogging & Audit frameworks7 3 1

Official textImplement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.312(b) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.AE-03 PR.PS-04	Information is correlated from multiple sources; Log records are generated and made available for continuous monitoring	Crosswalk	Same topic: Logging & Audit 9 loosely related (not mappings) DE.AE-02 Potentially adverse events are analyzed to better understand associated activities Loosely related Only shares CSF DE.AE-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident Loosely related Only shares CSF RS.AN-03: related, not a mapping RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved Loosely related Only shares CSF RS.AN-06: related, not a mapping …and 1 more in the downloads
ISO 27001	A.8.15 A.8.17	Logging; Clock synchronization	Crosswalk	Same topic: Logging & Audit 26 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.24 Information security incident management planning and preparation Loosely related Only shares CSF DE.AE-02, GV.OV-01: related, not a mapping A.5.25 Assessment and decision on information security events Loosely related Only shares CSF DE.AE-02, RS.AN-03: related, not a mapping A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-03, RS.AN-03: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping …and 18 more in the downloads
CIS v8.1	CIS 8.2 CIS 3.14 CIS 8.1 CIS 8.3 CIS 8.4 CIS 8.5 CIS 8.7 CIS 8.8 CIS 8.10 CIS 8.12	Collect Audit Logs; Log Sensitive Data Access…	Crosswalk	Same topic: Logging & Audit 9 loosely related (not mappings) CIS 17.8 Conduct Post-Incident Reviews Loosely related Only shares CSF ID.IM-03, RS.AN-03: related, not a mapping CIS 8.11 Conduct Audit Log Reviews Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 8.9 Centralize Audit Logs Loosely related Only shares CSF DE.AE-03: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.AE-03: related, not a mapping CIS 13.2 Deploy a Host-Based Intrusion Detection Solution Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 13.3 Deploy a Network Intrusion Detection Solution Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 13.7 Deploy a Host-Based Intrusion Prevention Solution Loosely related Only shares CSF DE.AE-02: related, not a mapping CIS 13.8 Deploy a Network Intrusion Prevention Solution Loosely related Only shares CSF DE.AE-02: related, not a mapping …and 1 more in the downloads
SOC 2	CC7.2	Monitoring system components for anomalies	Editorial	Same topic: Logging & Audit (editorial pick) 7 loosely related (not mappings) CC7.4 Responding to identified security incidents Loosely related Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping CC7.3 Evaluating security events to determine if they are incidents Loosely related Only shares CSF DE.AE-03: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03: related, not a mapping
PCI DSS	10.2.1 10.3.2 10.6.1 10.5.1	Audit logs enabled and active; Logs protected from modification…	Crosswalk	Same topic: Logging & Audit 50 loosely related (not mappings) 10.3.3 Logs promptly backed up to a central server Loosely related Only shares CSF DE.AE-02, DE.AE-03, PR.PS-04, RS.AN-06…: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-02, GV.SC-03, RS.AN-03: related, not a mapping 10.3.4 File-integrity monitoring on logs Loosely related Only shares CSF DE.AE-02, PR.PS-04, RS.AN-06: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.AE-02, DE.AE-03, RS.AN-03: related, not a mapping 10.2.2 Log entries record who, what, when, where and outcome Loosely related Only shares CSF RS.AN-03, RS.AN-07: related, not a mapping 10.3.1 Read access to logs limited to need Loosely related Only shares CSF PR.PS-04, RS.AN-06: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Loosely related Only shares CSF DE.AE-02, PR.PS-04: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping …and 42 more in the downloads
CMMC	AU.L2-3.3.1 AU.L2-3.3.2 AU.L2-3.3.7	System Auditing; User Accountability…	Crosswalk	Same topic: Logging & Audit 11 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping AU.L2-3.3.6 Reduction & Reporting Loosely related Only shares CSF PR.PS-04, RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 3 more in the downloads
800-53	AU-2 AU-3 AU-11 AU-12 AU-1 AU-4 AU-6 AU-7 AU-8	Event Logging; Content of Audit Records…	Crosswalk	Same topic: Logging & Audit NIST HIPAA → SP 800-53 crosswalk 40 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-4 Incident Handling Loosely related Only shares CSF DE.AE-02, DE.AE-03, ID.IM-01, ID.IM-02…: related, not a mapping …and 32 more in the downloads
GDPR	Art.24(2)Art.5(2)Art.28(1)	Responsibility of the controller; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.OC-03, GV.SC-03: related, not a mapping
NIS2	3.2	Monitoring and logging	Crosswalk	Same topic: Logging & Audit 7 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping 3.5 Incident response Loosely related Only shares CSF RS.AN-03: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping 2.3 Independent review of information and network security Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	ISM-1509 ISM-1623 ISM-1660 ISM-1683 ISM-1815	Privileged access events are centrally logged; PowerShell module logging, script block logging and transcription events are centrally……	Editorial	Same topic: Logging & Audit (editorial pick) 4 loosely related (not mappings) ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping ISM-1228 Cyber security events are analysed in a timely manner to identify cyber security incidents Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping
DORA	Art.10(3)	Detection	Editorial	Same topic: Logging & Audit (editorial pick) 13 loosely related (not mappings) Art.13(2) Learning and evolving Loosely related Only shares CSF ID.IM-03, RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping Art.17(2) ICT-related incident management process Loosely related Only shares CSF RS.AN-03, RS.AN-06, RS.AN-07: related, not a mapping Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.AE-02, DE.AE-03: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 5 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 22	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping +4 more loosely related (not mappings) Para 23 Detect and respond to incidents in a timely manner Loosely related Only shares CSF DE.AE-02: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.