Other Arrangements

frameworkHIPAA Security Rule section§164.314 Organizational requirements statusRequired csf 2.0DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-03 ID.AM-04 PR.DS-01 PR.DS-02 PR.DS-10 topics— frameworks1 0 0

Official textThe covered entity complies with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3).45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.314(a)(2)(ii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04	External service provider activities and services are monitored to find potentially adverse events; Outcomes, capabilities, and services that the organization depends on are understood and communicated…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.OC-05, GV.RR-04, GV.SC-04: related, not a mapping +12 more loosely related (not mappings) GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping …and 8 more in the downloads
ISO 27001	A.5.19 A.5.22 A.5.20 Clause 4.2	Information security in supplier relationships; Monitoring, review and change management of supplier services…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +48 more loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF GV.OC-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.RR-04, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 44 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 15.6 CIS 15.1	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +35 more loosely related (not mappings) CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 3.8 Document Data Flows Loosely related Only shares CSF ID.AM-03: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 31 more in the downloads
SOC 2	CC9.2 CC6.1 C1.2 CC6.5	Managing vendor and business partner risk; Logical access security over information assets…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +4 more loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	12.8.1 12.8.5 1.2.4 12.5.2	List of third-party service providers kept; Responsibilities split with each provider documented…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +52 more loosely related (not mappings) 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10…: related, not a mapping …and 48 more in the downloads
CMMC	RA.L2-3.11.1 SI.L2-3.14.6 SI.L2-3.14.7 SC.L2-3.13.1	Risk Assessments; Monitor Communications for Attacks…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +35 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 31 more in the downloads
800-53	CA-3 PS-6 PS-7 SA-9	Information Exchange; Access Agreements…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 59 loosely related (not mappings) SA-4 Acquisition Process Loosely related Only shares CSF DE.CM-06, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-06, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 51 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.5(1)(e)Art.5(1)(f)	Processor; Processor…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +6 more loosely related (not mappings) Art.32(1)(b) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 2 more in the downloads
NIS2	5.1 12.4 5.2 9.1	Supply chain security policy; Asset inventory…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +9 more loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 5 more in the downloads
Essential Eight	ISM-1807 ISM-1488	An automated method of asset discovery is used at least fortnightly to support the…; Microsoft Office macros in files originating from the internet are blocked	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, PR.DS-02: related, not a mapping
DORA	Art.28(8)Art.30(2)Art.28(3)Art.28(4)	General principles; Key contractual provisions…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +16 more loosely related (not mappings) Art.28(5) General principles Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 12 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +2 more loosely related (not mappings) Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Cyber Essentials	CE 3 CE 1 CE 4	Security Update Management; Firewalls…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.