HIPAA · §164.314 Organizational requirements
§164.314(b)
Requirements for Group Health Plans
frameworkHIPAA Security Rule
section§164.314 Organizational requirements
csf 2.0ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04
topics—
frameworks1 0 0
Official textExcept when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to § 164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-03ID.AM-08 | Representations of the organization's authorized network communication and internal and external network data flows are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles | No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| ISO 27001 | A.5.19A.5.8A.5.9A.5.11 | Information security in supplier relationships; Information security in project management… | No mapping. Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping+10 more loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads | |
| CIS v8.1 | CIS 1.1CIS 3.5CIS 3.8CIS 1.2 | Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data… | No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping+13 more loosely related (not mappings)CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads | |
| SOC 2 | CC6.1CC6.6 | Logical access security over information assets; Protection against threats from outside system boundaries | No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping | |
| PCI DSS | 6.3.312.3.41.2.31.2.4 | Security patches installed promptly; Hardware and software technologies reviewed annually… | No mapping. Only shares CSF ID.AM-08, ID.IM-03, ID.IM-01, ID.AM-03: related, not a mapping+11 more loosely related (not mappings)6.2.1 Bespoke and custom software developed securely Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads | |
| CMMC | CA.L2-3.12.4SC.L2-3.13.2MA.L2-3.7.1MA.L2-3.7.3 | System Security Plan; Security Engineering… | No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping | |
| 800-53 | PL-2 | System Security and Privacy Plans | Crosswalk | NIST HIPAA → SP 800-53 crosswalk19 loosely related (not mappings)SA-8 Security and Privacy Engineering Principles Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 11 more in the downloads |
| GDPR | Art.30(1) | Records of processing activities | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| NIS2 | 12.44.36.2 | Asset inventory; Crisis management… | No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping | |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.8(1)Art.8(4)Art.8(6)Art.9(4)(b) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08, ID.AM-03: related, not a mapping | |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 1CE 3 | Firewalls; Security Update Management | No mapping. Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.