HIPAA · §164.312 Technical safeguards
§164.312(d)
Person or Entity Authentication
frameworkHIPAA Security Rule
section§164.312 Technical safeguards
csf 2.0PR.AA-01 PR.AA-03 PR.AA-05
topicsAccess Control
frameworks1 10 1
Official textImplement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-01PR.AA-05 | Identities and credentials for authorized users, services, and hardware are managed by the organization; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Editorial | Same topic: Access Control (editorial pick)1 loosely related (not mappings)PR.AA-03 Users, services, and hardware are authenticated Only shares CSF PR.AA-03: related, not a mapping |
| ISO 27001 | A.5.15A.5.16A.5.18A.8.3 | Access control; Identity management… | Editorial | Same topic: Access Control (editorial pick)9 loosely related (not mappings)…and 1 more in the downloads |
| CIS v8.1 | CIS 3.3CIS 5.1CIS 5.2CIS 5.3CIS 5.5CIS 5.6CIS 6.1CIS 6.2CIS 6.6CIS 6.7CIS 6.8CIS 12.5 | Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts… | Editorial | Same topic: Access Control (editorial pick)12 loosely related (not mappings)CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 13.5 Manage Access Control for Remote Assets Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Only shares CSF PR.AA-05: related, not a mapping CIS 6.3 Require MFA for Externally-Exposed Applications Only shares CSF PR.AA-03: related, not a mapping …and 4 more in the downloads |
| SOC 2 | CC6.1CC6.2CC6.3 | Logical access security over information assets; User registration, authorization and removal… | Editorial | Same topic: Access Control (editorial pick) |
| PCI DSS | 7.2.17.2.27.2.48.2.1 | Access control model defined; Access assigned by job function and least privilege… | Editorial | Same topic: Access Control (editorial pick)31 loosely related (not mappings)3.5.1.3 Disk encryption access managed separately from OS access Only shares CSF PR.AA-03: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Only shares CSF PR.AA-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Only shares CSF PR.AA-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Only shares CSF PR.AA-01: related, not a mapping …and 23 more in the downloads |
| CMMC | AC.L2-3.1.1AC.L2-3.1.2 | Authorized Access Control; Transaction & Function Control | Editorial | Same topic: Access Control (editorial pick)31 loosely related (not mappings)IA.L2-3.5.4 Replay-Resistant Authentication Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping IA.L2-3.5.10 Cryptographically-Protected Passwords Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping …and 23 more in the downloads |
| 800-53 | AC-2AC-3IA-2IA-3IA-4IA-8IA-9 | Account Management; Access Enforcement… | Crosswalk | Same topic: Access Control (editorial pick) NIST HIPAA → SP 800-53 crosswalk 23 loosely related (not mappings)AC-14 Permitted Actions Without Identification or Authentication Only shares CSF PR.AA-01: related, not a mapping …and 15 more in the downloads |
| GDPR | Art.25(2)Art.32(1)(b) | Data protection by design and by default; Security of processing | Editorial | Same topic: Access Control (editorial pick) |
| NIS2 | 11.111.211.5 | Access control policy; Management of access rights… | Editorial | Same topic: Access Control (editorial pick) |
| Essential Eight | ISM-0445ISM-0974ISM-1173ISM-1175 | Privileged human users are assigned a dedicated privileged user account to be used…; Multi-factor authentication is used to authenticate unprivileged human users of systems… | No mapping. Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping+32 more loosely related (not mappings)ISM-1380 Privileged human users use separate privileged and unprivileged operating environments Only shares CSF PR.AA-05: related, not a mapping ISM-1387 Administrative activities are conducted through jump servers Only shares CSF PR.AA-05: related, not a mapping ISM-1401 Multi-factor authentication uses either: something people have and something people… Only shares CSF PR.AA-03: related, not a mapping ISM-1504 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… Only shares CSF PR.AA-03: related, not a mapping …and 28 more in the downloads | |
| DORA | Art.9(4)(c) | Protection and prevention | Editorial | Same topic: Access Control (editorial pick)1 loosely related (not mappings) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 4 | User Access Control | Editorial | Same topic: Access Control (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.