Time Limit

frameworkHIPAA Security Rule section§164.316 Policies and documentation statusRequired csf 2.0ID.AM-07 ID.AM-08 topics— frameworks1 0 0

Official textRetain documentation required by paragraph (b)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.316(b)(2)(i) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-07 ID.AM-08	Inventories of data and corresponding metadata for designated data types are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
ISO 27001	A.5.9 A.5.8 A.5.11 A.5.12	Inventory of information and other associated assets; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +6 more loosely related (not mappings) A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.2 CIS 3.5 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Data Inventory…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-07: related, not a mapping +7 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 3 more in the downloads
SOC 2	C1.1 CC6.1	Identifying and protecting confidential information; Logical access security over information assets	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
PCI DSS	3.2.1 3.4.1 3.4.2 6.2.1	Account data storage minimised, with retention and disposal; PAN masked when displayed…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +11 more loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CMMC	CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3 SC.L2-3.13.2	System Security Plan; Perform Maintenance…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +1 more loosely related (not mappings) MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-07: related, not a mapping
800-53	SI-12	Information Management and Retention	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 15 loosely related (not mappings) CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-12 Information Location Loosely related Only shares CSF ID.AM-07: related, not a mapping MA-2 Controlled Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 6.2	Asset inventory; Secure development life cycle	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.