Group Health Plan Implementation Specification

frameworkHIPAA Security Rule section§164.314 Organizational requirements statusRequired csf 2.0DE.CM-06 GV.OC-05 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-08 GV.SC-09 GV.SC-10 ID.AM-02 ID.AM-04 topics— frameworks1 0 0

Official textAmend plan documents to incorporate provisions to require the plan sponsor to ensure that any agent to whom it provides ePHI agrees to implement reasonable and appropriate security measures to protect the ePHI.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.314(b)(2)(iii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.OC-05 GV.SC-04 GV.SC-05	External service provider activities and services are monitored to find potentially adverse events; Outcomes, capabilities, and services that the organization depends on are understood and communicated…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-05: related, not a mapping +7 more loosely related (not mappings) GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping …and 3 more in the downloads
ISO 27001	A.5.19 A.5.22 A.5.20 Clause 6.1.1	Information security in supplier relationships; Monitoring, review and change management of supplier services…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +10 more loosely related (not mappings) Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09, GV.SC-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07, GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-09, GV.SC-10: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 15.4 CIS 15.7 CIS 15.6 CIS 15.1	Ensure Service Provider Contracts Include Security Requirements; Securely Decommission Service Providers…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +11 more loosely related (not mappings) CIS 2.1 Establish and Maintain a Software Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping CIS 15.3 Classify Service Providers Loosely related Only shares CSF GV.SC-04: related, not a mapping CIS 15.5 Assess Service Providers Loosely related Only shares CSF GV.SC-06: related, not a mapping …and 7 more in the downloads
SOC 2	CC9.2 CC6.1 CC3.1	Managing vendor and business partner risk; Logical access security over information assets…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping
PCI DSS	12.8.1 12.8.5 1.2.4 12.8.2	List of third-party service providers kept; Responsibilities split with each provider documented…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +28 more loosely related (not mappings) 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF DE.CM-06, GV.OC-05, GV.SC-04, GV.SC-07…: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OC-05, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, GV.SC-06, GV.SC-08, GV.SC-10: related, not a mapping …and 24 more in the downloads
CMMC	RA.L2-3.11.1 AC.L2-3.1.20 AC.L2-3.1.21 CA.L2-3.12.3	Risk Assessments; External Connections…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping +7 more loosely related (not mappings) CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF GV.SC-08: related, not a mapping IR.L2-3.6.2 Incident Reporting Loosely related Only shares CSF GV.SC-08: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 3 more in the downloads
800-53	SA-9	External System Services	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 24 loosely related (not mappings) SA-4 Acquisition Process Loosely related Only shares CSF DE.CM-06, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07…: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09…: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, GV.SC-05, GV.SC-06, GV.SC-09…: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05, GV.SC-09, GV.SC-10: related, not a mapping AC-20 Use of External Systems Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-05, GV.SC-09: related, not a mapping …and 16 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.30(1)	Processor; Processor…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping
NIS2	5.1 5.2 12.4 13.1	Supply chain security policy; Directory of suppliers and service providers…	Loosely related	No mapping. Only shares CSF GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +3 more loosely related (not mappings) 3.1 Incident handling policy Loosely related Only shares CSF GV.SC-08: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.SC-08: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.SC-06: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
DORA	Art.28(8)Art.30(2)Art.28(3)Art.28(4)	General principles; Key contractual provisions…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping +9 more loosely related (not mappings) Art.28(5) General principles Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping Art.8(4) Identification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 5 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping +1 more loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.