HIPAA · §164.314 Organizational requirements
§164.314(b)(2)(iv)
Group Health Plan Implementation Specification
frameworkHIPAA Security Rule
section§164.314 Organizational requirements
statusRequired
csf 2.0RC.CO-03 RS.AN-06 RS.AN-07 RS.CO-02 RS.CO-03 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04
topics—
frameworks1 0 1
Official textAmend plan documents to incorporate provisions to require the plan sponsor to report any security incident of which it becomes aware to the group health plan.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RC.CO-03RS.AN-06RS.AN-07RS.CO-02 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders; Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved… | No mapping. Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.CO-02: related, not a mapping+5 more loosely related (not mappings)RS.CO-03 Information is shared with designated internal and external stakeholders Only shares CSF RS.CO-03: related, not a mapping RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared Only shares CSF RS.MA-01: related, not a mapping RS.MA-02 Incident reports are triaged and validated Only shares CSF RS.MA-02: related, not a mapping …and 1 more in the downloads | |
| ISO 27001 | A.5.26A.5.28Clause 7.4A.5.27 | Response to information security incidents; Collection of evidence… | No mapping. Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping | |
| CIS v8.1 | CIS 17.2CIS 17.4CIS 17.1CIS 17.5 | Establish and Maintain Contact Information for Reporting Security Incidents; Establish and Maintain an Incident Response Process… | No mapping. Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-02…: related, not a mapping+4 more loosely related (not mappings)CIS 17.7 Conduct Routine Incident Response Exercises Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping CIS 17.9 Establish and Maintain Security Incident Thresholds Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping CIS 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents Only shares CSF RS.CO-02: related, not a mapping CIS 17.6 Define Mechanisms for Communicating During Incident Response Only shares CSF RS.CO-03: related, not a mapping | |
| SOC 2 | CC7.4CC7.3CC2.3CC7.5 | Responding to identified security incidents; Evaluating security events to determine if they are incidents… | No mapping. Only shares CSF RS.AN-06, RS.AN-07, RS.MA-01, RS.MA-02…: related, not a mapping | |
| PCI DSS | 12.10.112.8.212.10.312.10.2 | Incident response plan ready to activate; Written agreements with service providers… | No mapping. Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| CMMC | IR.L2-3.6.2IR.L2-3.6.1AU.L2-3.3.6IR.L2-3.6.3 | Incident Reporting; Incident Handling… | No mapping. Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.CO-02…: related, not a mapping | |
| 800-53 | IR-6 | Incident Reporting | Crosswalk | NIST HIPAA → SP 800-53 crosswalk9 loosely related (not mappings)IR-4 Incident Handling Only shares CSF RC.CO-03, RS.AN-06, RS.AN-07, RS.CO-02…: related, not a mapping IR-7 Incident Response Assistance Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01, RS.MA-04: related, not a mapping SR-8 Notification Agreements Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping SR-3 Supply Chain Controls and Processes Only shares CSF RS.CO-02, RS.CO-03, RS.MA-01: related, not a mapping AU-7 Audit Record Reduction and Report Generation Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping IR-2 Incident Response Training Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping …and 1 more in the downloads |
| GDPR | Art.33(1)Art.33(5)Art.34(1) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority… | No mapping. Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| NIS2 | 3.53.43.24.3 | Incident response; Event assessment and classification… | No mapping. Only shares CSF RC.CO-03, RS.CO-02, RS.CO-03, RS.MA-01…: related, not a mapping | |
| Essential Eight | ISM-1819ISM-0123ISM-0140 | Following the identification of a cyber security incident, the cyber security incident…; Cyber security incidents are reported to the chief information security officer, or one…… | No mapping. Only shares CSF RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04…: related, not a mapping | |
| DORA | Art.18(1)Art.11(2)(b)Art.17(1)Art.17(3) | Classification of ICT-related incidents and cyber threats; Response and recovery… | No mapping. Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping+10 more loosely related (not mappings)Art.17(2) ICT-related incident management process Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping …and 6 more in the downloads | |
| CPS 234 | Para 25Para 23Para 24Para 26 | Response plans cover all stages and escalation; Detect and respond to incidents in a timely manner… | No mapping. Only shares CSF RS.CO-03, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.