Business Associate Contracts or Other Arrangements

frameworkHIPAA Security Rule section§164.314 Organizational requirements csf 2.0DE.CM-06 GV.OC-05 GV.RR-04 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-04 ID.AM-08 ID.IM-03 ID.RA-09 topicsVendor Risk Mgmt frameworks6 4 0

Official text(i) The contract or other arrangement between the covered entity and its business associate required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable. (ii) A covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3). (iii) The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.314(a) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Crosswalk	Same topic: Vendor Risk Mgmt 10 loosely related (not mappings) GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained Loosely related Only shares CSF ID.AM-02: related, not a mapping ID.AM-04 Inventories of services provided by suppliers are maintained Loosely related Only shares CSF ID.AM-04: related, not a mapping …and 2 more in the downloads
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Crosswalk	Same topic: Vendor Risk Mgmt 26 loosely related (not mappings) Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.8 Information security in project management Loosely related Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-02, ID.AM-08: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping …and 18 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.5 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Crosswalk	Same topic: Vendor Risk Mgmt 13 loosely related (not mappings) CIS 1.1 Establish and Maintain Detailed Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 6.1 Establish an Access Granting Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 6.2 Establish an Access Revoking Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping …and 5 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 2 loosely related (not mappings) CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 34 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, GV.SC-09, GV.SC-10, ID.AM-02…: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, ID.AM-02: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-07, GV.SC-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-07, GV.SC-09, ID.AM-08: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.SC-09, ID.AM-08, ID.IM-03: related, not a mapping …and 26 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.20 AC.L2-3.1.21 CA.L2-3.12.3	Risk Assessments; External Connections…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +14 more loosely related (not mappings) CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06, ID.IM-03: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF GV.SC-08, ID.IM-03: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping …and 10 more in the downloads
800-53	SA-4 SA-9 SR-6 PS-6 PS-7	Acquisition Process; External System Services…	Crosswalk	Same topic: Vendor Risk Mgmt NIST HIPAA → SP 800-53 crosswalk 44 loosely related (not mappings) SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10, ID.IM-03: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.IM-03: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.IM-03: related, not a mapping AC-20 Use of External Systems Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06, ID.IM-03: related, not a mapping …and 36 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 3 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Crosswalk	Same topic: Vendor Risk Mgmt 8 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.2 Verification of Background Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 8 loosely related (not mappings) Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.8(6) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.11(5) Response and recovery Loosely related Only shares CSF GV.OC-05: related, not a mapping
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.