Policies and Procedures

frameworkHIPAA Security Rule section§164.316 Policies and documentation csf 2.0DE.AE-07 GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.RM-06 GV.RM-07 GV.SC-03 GV.SC-09 GV.SC-10 ID.AM-03 ID.AM-05 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 ID.RA-01 ID.RA-03 ID.RA-04 ID.RA-05 RS.AN-08 topicsGovernance Policy frameworks5 4 0

Official textImplement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.316(a) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.PO-01 GV.PO-02	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	Crosswalk	Same topic: Governance Policy 16 loosely related (not mappings) DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis Loosely related Only shares CSF DE.AE-07: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Loosely related Only shares CSF GV.OV-01: related, not a mapping GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated Loosely related Only shares CSF GV.RM-06: related, not a mapping GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions Loosely related Only shares CSF GV.RM-07: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle Loosely related Only shares CSF GV.SC-09: related, not a mapping GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Loosely related Only shares CSF GV.SC-10: related, not a mapping …and 8 more in the downloads
ISO 27001	A.5.1 A.5.37 Clause 5.2	Policies for information security; Documented operating procedures…	Crosswalk	Same topic: Governance Policy 39 loosely related (not mappings) A.5.19 Information security in supplier relationships Loosely related Only shares CSF GV.OV-01, GV.SC-03, GV.SC-09, GV.SC-10…: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.RM-07, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-06, GV.SC-09, GV.SC-10, ID.RA-03…: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-03: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-10, ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF DE.AE-07, ID.RA-03, ID.RA-05: related, not a mapping A.5.21 Managing information security in the ICT supply chain Loosely related Only shares CSF GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping …and 31 more in the downloads
CIS v8.1	CIS 3.8 CIS 1.1 CIS 3.5 CIS 3.7	Document Data Flows; Establish and Maintain Detailed Enterprise Asset Inventory…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-05, ID.AM-08: related, not a mapping +26 more loosely related (not mappings) CIS 7.1 Establish and Maintain a Vulnerability Management Process Loosely related Only shares CSF ID.RA-01: related, not a mapping CIS 15.6 Monitor Service Providers Loosely related Only shares CSF GV.SC-09: related, not a mapping CIS 15.7 Securely Decommission Service Providers Loosely related Only shares CSF GV.SC-10: related, not a mapping CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 22 more in the downloads
SOC 2	CC1.1 CC5.3	Commitment to integrity and ethical values; Control activities deployed through policies and procedures	Editorial	Same topic: Governance Policy (editorial pick) 13 loosely related (not mappings) CC3.2 Risk identification and analysis Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.3 Considering the potential for fraud Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC3.4 Identifying and assessing significant changes Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping C1.1 Identifying and protecting confidential information Loosely related Only shares CSF ID.AM-05: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.RM-06: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 5 more in the downloads
PCI DSS	12.1.1 12.1.2	Information security policy established and published; Security policy reviewed at least annually	Crosswalk	Same topic: Governance Policy 69 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF GV.OV-01, GV.RM-06, ID.AM-05, ID.IM-01…: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF DE.AE-07, GV.RM-06, GV.SC-03, GV.SC-09…: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-06, GV.SC-09, ID.AM-08, ID.IM-03…: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF GV.RM-06, GV.SC-03, GV.SC-09, ID.AM-05…: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF DE.AE-07, GV.SC-03, GV.SC-09, GV.SC-10: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-10, ID.AM-03, RS.AN-08: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-10, ID.AM-03, RS.AN-08: related, not a mapping …and 61 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.4 CA.L2-3.12.1 RA.L2-3.11.2	Risk Assessments; System Security Plan…	Loosely related	No mapping. Only shares CSF DE.AE-07, GV.OV-01, GV.RM-06, GV.RM-07…: related, not a mapping +11 more loosely related (not mappings) RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RS.AN-08: related, not a mapping …and 7 more in the downloads
800-53	PL-1 PM-1 PL-2 RA-1 RA-3	Policy and Procedures; Information Security Program Plan…	Crosswalk	Same topic: Governance Policy NIST HIPAA → SP 800-53 crosswalk 64 loosely related (not mappings) RA-7 Risk Response Loosely related Only shares CSF GV.OV-01, GV.SC-03, GV.SC-09, GV.SC-10…: related, not a mapping AC-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping AU-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CM-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping CP-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping IA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02…: related, not a mapping …and 56 more in the downloads
GDPR	Art.24(2)	Responsibility of the controller	Editorial	Same topic: Governance Policy (editorial pick) 8 loosely related (not mappings) Art.35(1) Data protection impact assessment Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.35(7) Data protection impact assessment Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.24(1) Responsibility of the controller Loosely related Only shares CSF GV.RM-06: related, not a mapping Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-08: related, not a mapping Art.32(1)(d) Security of processing Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.32(2) Security of processing Loosely related Only shares CSF GV.RM-06: related, not a mapping
NIS2	1.1	Policy on the security of network and information systems	Crosswalk	Same topic: Governance Policy 13 loosely related (not mappings) 2.1 Risk management framework Loosely related Only shares CSF GV.RM-06, ID.RA-01, ID.RA-03, ID.RA-04…: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03, GV.SC-09, GV.SC-10: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01, ID.RA-04, ID.RA-05: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.AE-07, ID.AM-03: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-03, ID.AM-08: related, not a mapping 3.6 Post-incident reviews Loosely related Only shares CSF RS.AN-08: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 5 more in the downloads
Essential Eight	ISM-1807 ISM-0304 ISM-1407 ISM-1501	An automated method of asset discovery is used at least fortnightly to support the…; Applications other than office productivity suites, web browsers and their extensions……	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Governance Policy (editorial pick) 23 loosely related (not mappings) Art.8(2) Identification Loosely related Only shares CSF DE.AE-07, ID.RA-01, ID.RA-03, ID.RA-04…: related, not a mapping Art.8(3) Identification Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.8(7) Identification Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Art.8(1) Identification Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Art.13(1) Learning and evolving Loosely related Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping Art.28(2) General principles Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(1) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Art.29(2) Preliminary assessment of ICT concentration risk at entity level Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping …and 15 more in the downloads
CPS 234	Para 18 Para 19	Maintain an information security policy framework; Policies direct everyone with security obligations	Editorial	Same topic: Governance Policy (editorial pick) 13 loosely related (not mappings) Para 17 Keep capability current as threats and vulnerabilities change Loosely related Only shares CSF DE.AE-07, ID.RA-01, ID.RA-03, ID.RA-04…: related, not a mapping Para 21 Timely controls commensurate with risk and asset life-cycle Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping Para 27 Systematic testing programme for control effectiveness Loosely related Only shares CSF GV.RM-06, ID.RA-01: related, not a mapping Para 13 Board ultimately responsible for information security Loosely related Only shares CSF GV.RM-06: related, not a mapping Para 15 Maintain a capability commensurate with threats Loosely related Only shares CSF GV.RM-06: related, not a mapping …and 5 more in the downloads
Cyber Essentials	CE 3 CE 1	Security Update Management; Firewalls	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01, ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.