Integrity

frameworkHIPAA Security Rule section§164.312 Technical safeguards csf 2.0DE.CM-09 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.SC-03 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-09 PR.DS-01 PR.DS-02 PR.DS-10 PR.DS-11 PR.PS-02 RC.RP-03 topicsData Protection frameworks7 4 0

Official textImplement policies and procedures to protect electronic protected health information from improper alteration or destruction.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.312(c) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.DS-01 PR.DS-02 PR.DS-10	The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected…	Crosswalk	Same topic: Data Protection 10 loosely related (not mappings) DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-09: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Loosely related Only shares CSF GV.PO-01: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use Loosely related Only shares CSF ID.RA-09: related, not a mapping PR.DS-11 Backups of data are created, protected, maintained, and tested Loosely related Only shares CSF PR.DS-11: related, not a mapping …and 2 more in the downloads
ISO 27001	A.5.14 A.8.10 A.8.11	Information transfer; Information deletion…	Crosswalk	Same topic: Data Protection 51 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping Clause 5.2 Policy Loosely related Only shares CSF GV.PO-01, GV.PO-02, PR.DS-01, PR.DS-02…: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02, ID.RA-09: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.PO-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.PO-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.PO-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 43 more in the downloads
CIS v8.1	CIS 3.11 CIS 3.1 CIS 3.4 CIS 3.5 CIS 3.12	Encrypt Sensitive Data at Rest; Establish and Maintain a Data Management Process…	Crosswalk	Same topic: Data Protection 28 loosely related (not mappings) CIS 11.5 Test Data Recovery Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping CIS 2.2 Ensure Authorized Software is Currently Supported Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF PR.PS-02: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 10.1 Deploy and Maintain Anti-Malware Software Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 11.2 Perform Automated Backups Loosely related Only shares CSF PR.DS-11: related, not a mapping CIS 11.3 Protect Recovery Data Loosely related Only shares CSF PR.DS-11: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 20 more in the downloads
SOC 2	C1.2 CC6.5	Disposing of confidential information; Protection of data when assets are disposed of	Editorial	Same topic: Data Protection (editorial pick) 11 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, ID.RA-09: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 3 more in the downloads
PCI DSS	3.2.1 3.3.1 3.4.1	Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation…	Crosswalk	Same topic: Data Protection 68 loosely related (not mappings) 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.CM-09, GV.SC-03, ID.RA-09: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Loosely related Only shares CSF GV.OC-03, PR.DS-01, PR.DS-11: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF GV.SC-03, ID.IM-01, PR.PS-02: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Loosely related Only shares CSF DE.CM-09, RC.RP-03: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-03, PR.PS-02: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-03, PR.PS-02: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF ID.IM-03, PR.PS-02: related, not a mapping 9.4.1.1 Offline backup media stored securely Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 60 more in the downloads
CMMC	SC.L2-3.13.16 MP.L2-3.8.3	Data at Rest; Media Disposal	Crosswalk	Same topic: Data Protection 36 loosely related (not mappings) SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-09, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping MP.L2-3.8.9 Protect Backups Loosely related Only shares CSF PR.DS-01, PR.DS-10, PR.DS-11, RC.RP-03: related, not a mapping …and 28 more in the downloads
800-53	SC-8 SC-28 SI-7 CP-9 MP-2 MP-5 SI-1	Transmission Confidentiality and Integrity; Protection of Information at Rest…	Crosswalk	Same topic: Data Protection NIST HIPAA → SP 800-53 crosswalk 79 loosely related (not mappings) AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IR-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 71 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Editorial	Same topic: Data Protection (editorial pick) 6 loosely related (not mappings) Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, ID.RA-09: related, not a mapping Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.32(1)(c) Security of processing Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping
NIS2	12.2 12.3	Handling of assets; Removable media policy	Crosswalk	Same topic: Data Protection 10 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02, ID.RA-09: related, not a mapping 6.6 Security patch management Loosely related Only shares CSF DE.CM-09, PR.PS-02: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 4.2 Backup management Loosely related Only shares CSF PR.DS-11: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-09: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF PR.PS-02: related, not a mapping …and 2 more in the downloads
Essential Eight	ISM-1488 ISM-1511 ISM-1515 ISM-1705	Microsoft Office macros in files originating from the internet are blocked; Backups of data, applications and settings are performed and retained in accordance……	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.DS-02, PR.DS-11, RC.RP-03: related, not a mapping +46 more loosely related (not mappings) ISM-1706 Privileged user accounts (excluding backup administrator accounts) cannot access their… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1707 Privileged user accounts (excluding backup administrator accounts) are prevented from… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1708 Backup administrator accounts are prevented from modifying and deleting backups during… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping ISM-1810 Backups of data, applications and settings are synchronised to enable restoration to a… Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 42 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Data Protection (editorial pick) 18 loosely related (not mappings) Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(a) Protection and prevention Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.12(1) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(2) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping Art.12(3) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping …and 10 more in the downloads
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Data Protection (editorial pick) 7 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, ID.RA-09: related, not a mapping Para 18 Maintain an information security policy framework Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 19 Policies direct everyone with security obligations Loosely related Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, ID.RA-09: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 3 CE 5	Security Update Management; Malware protection	Loosely related	No mapping. Only shares CSF PR.PS-02, DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.