Business associate contracts with subcontractors

frameworkHIPAA Security Rule section§164.314 Organizational requirements statusRequired csf 2.0DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-04 ID.AM-08 ID.IM-03 ID.RA-09 RC.CO-03 RS.AN-06 RS.AN-07 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topics— frameworks1 0 0

Official textThe requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.314(a)(2)(iii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04	External service provider activities and services are monitored to find potentially adverse events; Outcomes, capabilities, and services that the organization depends on are understood and communicated…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.OC-05, GV.RR-04, GV.SC-04: related, not a mapping +19 more loosely related (not mappings) GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping …and 15 more in the downloads
ISO 27001	A.5.19 A.5.22 A.5.20 A.5.26	Information security in supplier relationships; Monitoring, review and change management of supplier services…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +31 more loosely related (not mappings) A.5.28 Collection of evidence Loosely related Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.MA-01…: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-03, RS.MA-01, RS.MA-02: related, not a mapping …and 27 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 15.6 CIS 15.1	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +23 more loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 19 more in the downloads
SOC 2	CC9.2 CC7.4 CC7.3 CC2.3	Managing vendor and business partner risk; Responding to identified security incidents…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +3 more loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping CC7.5 Recovering from identified security incidents Loosely related Only shares CSF ID.IM-03, RC.CO-03: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping
PCI DSS	12.8.2 12.8.1 12.8.5 12.10.1	Written agreements with service providers; List of third-party service providers kept…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +45 more loosely related (not mappings) 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02…: related, not a mapping …and 41 more in the downloads
CMMC	IR.L2-3.6.1 IR.L2-3.6.2 RA.L2-3.11.1 AC.L2-3.1.20	Incident Handling; Incident Reporting…	Loosely related	No mapping. Only shares CSF GV.SC-08, ID.IM-03, RC.CO-03, RS.AN-06…: related, not a mapping +16 more loosely related (not mappings) AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping AU.L2-3.3.6 Reduction & Reporting Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-06, ID.IM-03: related, not a mapping CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping …and 12 more in the downloads
800-53	IR-6 PS-6 PS-7 SA-4 SA-9	Incident Reporting; Access Agreements…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 52 loosely related (not mappings) IR-4 Incident Handling Loosely related Only shares CSF ID.IM-03, RC.CO-03, RS.AN-06, RS.AN-07…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF GV.SC-08, RC.CO-03, RS.CO-02, RS.CO-03…: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10, ID.IM-03: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping …and 44 more in the downloads
GDPR	Art.28(1)Art.33(1)Art.28(3)Art.33(5)	Processor; Notification of a personal data breach to the supervisory authority…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +4 more loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.34(1) Communication of a personal data breach to the data subject Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	3.5 5.1 3.4 12.4	Incident response; Supply chain security policy…	Loosely related	No mapping. Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping +12 more loosely related (not mappings) 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08, RS.MA-01: related, not a mapping 3.2 Monitoring and logging Loosely related Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF RS.CO-02, RS.CO-03: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.OC-05, GV.SC-04: related, not a mapping …and 8 more in the downloads
Essential Eight	ISM-1819 ISM-1807 ISM-0123 ISM-0140	Following the identification of a cyber security incident, the cyber security incident…; An automated method of asset discovery is used at least fortnightly to support the……	Loosely related	No mapping. Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04…: related, not a mapping
DORA	Art.18(1)Art.28(8)Art.30(2)Art.8(1)	Classification of ICT-related incidents and cyber threats; General principles…	Loosely related	No mapping. Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping +24 more loosely related (not mappings) Art.11(2)(b) Response and recovery Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.17(1) ICT-related incident management process Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.17(3) ICT-related incident management process Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Art.28(3) General principles Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping …and 20 more in the downloads
CPS 234	Para 16 Para 22 Para 25 Para 23	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +7 more loosely related (not mappings) Para 24 Maintain information security response plans Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Para 26 Review and test response plans annually Loosely related Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping …and 3 more in the downloads
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.