Group Health Plan Implementation Specification

frameworkHIPAA Security Rule section§164.314 Organizational requirements statusRequired csf 2.0ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 topics— frameworks1 0 0

Official textAmend the plan documents to incorporate provisions to require the plan sponsor to implement administrative, technical, and physical safeguards that will reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of the group health plan.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.314(b)(2)(i) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 ID.AM-08	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
ISO 27001	A.5.19 A.5.8 A.5.9 A.5.11	Information security in supplier relationships; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping +10 more loosely related (not mappings) A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 3.8 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping +13 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
SOC 2	CC6.1 CC6.6	Logical access security over information assets; Protection against threats from outside system boundaries	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
PCI DSS	6.3.3 12.3.4 1.2.3 1.2.4	Security patches installed promptly; Hardware and software technologies reviewed annually…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-03, ID.IM-01, ID.AM-03: related, not a mapping +11 more loosely related (not mappings) 6.2.1 Bespoke and custom software developed securely Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CMMC	CA.L2-3.12.4 SC.L2-3.13.2 MA.L2-3.7.1 MA.L2-3.7.3	System Security Plan; Security Engineering…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping
800-53	PL-2	System Security and Privacy Plans	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 19 loosely related (not mappings) SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SA-4 Acquisition Process Loosely related Only shares CSF ID.AM-08, ID.IM-03: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-9 Internal System Connections Loosely related Only shares CSF ID.AM-03: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 11 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 4.3 6.2	Asset inventory; Crisis management…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.9(4)(b)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
Cyber Essentials	CE 1 CE 3	Firewalls; Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.