Availability

frameworkHIPAA Security Rule section§164.316 Policies and documentation statusRequired csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.RR-04 GV.SC-03 GV.SC-08 ID.IM-01 ID.IM-02 ID.IM-03 PR.AA-01 PR.AA-05 PR.PS-01 RC.RP-04 topics— frameworks1 0 0

Official textMake documentation available to those persons responsible for implementing the procedures to which the documentation pertains.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.316(b)(2)(ii) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.OV-01, GV.PO-01, GV.PO-02: related, not a mapping +7 more loosely related (not mappings) GV.RR-04 Cybersecurity is included in human resources practices Loosely related Only shares CSF GV.RR-04: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Loosely related Only shares CSF GV.SC-03: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Loosely related Only shares CSF GV.SC-08: related, not a mapping PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 3 more in the downloads
ISO 27001	A.5.1 A.6.7 A.5.19 A.5.15	Policies for information security; Remote working…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.PO-01, GV.PO-02, GV.SC-03…: related, not a mapping +36 more loosely related (not mappings) A.5.16 Identity management Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.5.18 Access rights Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping …and 32 more in the downloads
CIS v8.1	CIS 6.1 CIS 6.2 CIS 5.1 CIS 3.3	Establish an Access Granting Process; Establish an Access Revoking Process…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.AA-01, PR.AA-05: related, not a mapping +23 more loosely related (not mappings) CIS 4.1 Establish and Maintain a Secure Configuration Process Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure Loosely related Only shares CSF PR.PS-01: related, not a mapping CIS 5.6 Centralize Account Management Loosely related Only shares CSF PR.AA-01: related, not a mapping CIS 6.7 Centralize Access Control Loosely related Only shares CSF PR.AA-01: related, not a mapping …and 19 more in the downloads
SOC 2	CC1.1 CC5.3 CC6.1 CC6.2	Commitment to integrity and ethical values; Control activities deployed through policies and procedures…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, PR.AA-01, PR.AA-05: related, not a mapping +11 more loosely related (not mappings) CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-03, PR.PS-01: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF RC.RP-04: related, not a mapping …and 7 more in the downloads
PCI DSS	12.10.2 12.10.6 1.2.3 1.2.4	Incident response plan reviewed and tested annually; Plan updated from lessons learned and industry changes…	Loosely related	No mapping. Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, RC.RP-04: related, not a mapping +61 more loosely related (not mappings) 7.1.1 Access restriction policies documented and kept current Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF GV.RR-04, PR.AA-05: related, not a mapping 8.1.1 Identification and authentication policies documented Loosely related Only shares CSF GV.PO-02, PR.AA-05: related, not a mapping 10.7.1 Service providers detect security control failures Loosely related Only shares CSF GV.OV-01, ID.IM-03: related, not a mapping …and 57 more in the downloads
CMMC	CM.L2-3.4.9 RA.L2-3.11.1 CA.L2-3.12.1 IR.L2-3.6.1	User-Installed Software; Risk Assessments…	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, PR.AA-05…: related, not a mapping +42 more loosely related (not mappings) AC.L2-3.1.1 Authorized Access Control Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping SC.L2-3.13.7 Split Tunneling Loosely related Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 38 more in the downloads
800-53	AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MA-1 MP-1 PE-1 PL-1 PM-1 PS-1 PT-1 RA-1 SA-1 SC-1 SI-1 SR-1	Policy and Procedures; Policy and Procedures…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 58 loosely related (not mappings) RA-7 Risk Response Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02…: related, not a mapping CA-2 Control Assessments Loosely related Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping IR-8 Incident Response Plan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.RP-04: related, not a mapping PM-31 Continuous Monitoring Strategy Loosely related Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02, ID.IM-03: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping PM-9 Risk Management Strategy Loosely related Only shares CSF GV.OV-01, GV.SC-03, RC.RP-04: related, not a mapping AC-2 Account Management Loosely related Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.OV-01, GV.SC-03: related, not a mapping …and 50 more in the downloads
GDPR	Art.32(1)(b)Art.24(2)Art.25(2)Art.28(1)	Security of processing; Responsibility of the controller…	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, RC.RP-04, GV.PO-01…: related, not a mapping +3 more loosely related (not mappings) Art.5(2) Principles relating to processing of personal data Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.29 Processing under the authority of the controller or processor Loosely related Only shares CSF GV.RR-04: related, not a mapping Art.32(4) Security of processing Loosely related Only shares CSF GV.RR-04: related, not a mapping
NIS2	1.1 11.5 3.1 4.1	Policy on the security of network and information systems; Identification…	Loosely related	No mapping. Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AA-01…: related, not a mapping +12 more loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02: related, not a mapping 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 8 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +47 more loosely related (not mappings) ISM-1412 Web browsers are hardened using ASD and vendor hardening guidance, with the most… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1485 Web browsers do not process web advertisements from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 43 more in the downloads
DORA	Art.5(2)(b)Art.6(5)Art.9(4)(a)Art.9(4)(c)	Governance and organisation; ICT risk management framework…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, PR.AA-01, PR.AA-05: related, not a mapping +12 more loosely related (not mappings) Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(7) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.10(3) Detection Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 8 more in the downloads
CPS 234	Para 18 Para 19 Para 16 Para 22	Maintain an information security policy framework; Policies direct everyone with security obligations…	Loosely related	No mapping. Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping +3 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	CE 4 CE 2	User Access Control; Secure Configuration	Loosely related	No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.