HIPAA · §164.316 Policies and documentation
§164.316(b)(2)(iii)
Updates
frameworkHIPAA Security Rule
section§164.316 Policies and documentation
statusRequired
csf 2.0GV.OC-03 GV.OV-01 GV.PO-01 GV.PO-02 GV.RR-04 GV.SC-03 GV.SC-08 ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 PR.AA-01 PR.AA-05 PR.PS-01 RC.RP-04
topicsGovernance Policy
frameworks5 4 0
Official textReview documentation periodically and update as needed in response to environmental or operational changes that affect the security of the ePHI.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.PO-01GV.PO-02 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | Same topic: Governance Policy11 loosely related (not mappings)GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Only shares CSF GV.OV-01: related, not a mapping GV.RR-04 Cybersecurity is included in human resources practices Only shares CSF GV.RR-04: related, not a mapping GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes Only shares CSF GV.SC-03: related, not a mapping GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities Only shares CSF GV.SC-08: related, not a mapping ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Only shares CSF ID.AM-03: related, not a mapping ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles Only shares CSF ID.AM-08: related, not a mapping PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization Only shares CSF PR.AA-01: related, not a mapping …and 3 more in the downloads |
| ISO 27001 | A.5.1A.5.37Clause 5.2 | Policies for information security; Documented operating procedures… | Crosswalk | Same topic: Governance Policy49 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.OV-01, GV.SC-03, ID.AM-08, ID.IM-02: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Only shares CSF GV.OV-01, ID.IM-03, ID.IM-04: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03, GV.SC-03: related, not a mapping …and 41 more in the downloads |
| CIS v8.1 | CIS 6.1CIS 6.2CIS 5.1CIS 1.1 | Establish an Access Granting Process; Establish an Access Revoking Process… | No mapping. Only shares CSF GV.RR-04, PR.AA-01, PR.AA-05, ID.AM-08: related, not a mapping+40 more loosely related (not mappings)CIS 4.1 Establish and Maintain a Secure Configuration Process Only shares CSF PR.PS-01: related, not a mapping …and 36 more in the downloads | |
| SOC 2 | CC1.1CC5.3 | Commitment to integrity and ethical values; Control activities deployed through policies and procedures | Editorial | Same topic: Governance Policy (editorial pick)13 loosely related (not mappings)CC6.1 Logical access security over information assets Only shares CSF ID.AM-08, PR.AA-01, PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping CC9.2 Managing vendor and business partner risk Only shares CSF GV.SC-03, PR.PS-01: related, not a mapping A1.1 Capacity management to meet availability commitments Only shares CSF RC.RP-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF RC.RP-04: related, not a mapping …and 5 more in the downloads |
| PCI DSS | 12.1.112.1.2 | Information security policy established and published; Security policy reviewed at least annually | Crosswalk | Same topic: Governance Policy72 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, ID.IM-04: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF GV.OV-01, GV.SC-08, ID.IM-02, ID.IM-04: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.SC-08, ID.AM-03, RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-08, ID.AM-03, RC.RP-04: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.SC-03, ID.AM-08, ID.IM-01: related, not a mapping 12.10.1 Incident response plan ready to activate Only shares CSF GV.SC-08, ID.IM-04, RC.RP-04: related, not a mapping 6.2.3 Custom code reviewed before release Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-03, ID.AM-08: related, not a mapping …and 64 more in the downloads |
| CMMC | CA.L2-3.12.4CM.L2-3.4.9RA.L2-3.11.1CA.L2-3.12.1 | System Security Plan; User-Installed Software… | No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping+46 more loosely related (not mappings)IR.L2-3.6.1 Incident Handling Only shares CSF GV.SC-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 42 more in the downloads | |
| 800-53 | PL-1PM-1AC-1AT-1AU-1CA-1CM-1CP-1IA-1IR-1MA-1MP-1PE-1PL-2PS-1PT-1RA-1SA-1SC-1SI-1SR-1 | Policy and Procedures; Information Security Program Plan… | Crosswalk | Same topic: Governance Policy NIST HIPAA → SP 800-53 crosswalk 75 loosely related (not mappings)IR-8 Incident Response Plan Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04…: related, not a mapping CA-2 Control Assessments Only shares CSF GV.OC-03, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping PM-31 Continuous Monitoring Strategy Only shares CSF GV.OV-01, GV.SC-03, ID.IM-02, ID.IM-03: related, not a mapping SA-8 Security and Privacy Engineering Principles Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 67 more in the downloads |
| GDPR | Art.24(2) | Responsibility of the controller | Editorial | Same topic: Governance Policy (editorial pick)7 loosely related (not mappings)Art.32(1)(b) Security of processing Only shares CSF PR.AA-01, PR.AA-05, RC.RP-04: related, not a mapping Art.25(2) Data protection by design and by default Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OC-03: related, not a mapping Art.29 Processing under the authority of the controller or processor Only shares CSF GV.RR-04: related, not a mapping |
| NIS2 | 1.1 | Policy on the security of network and information systems | Crosswalk | Same topic: Governance Policy18 loosely related (not mappings)6.1 Security in acquisition of ICT services, ICT systems or ICT products Only shares CSF GV.PO-02: related, not a mapping …and 10 more in the downloads |
| Essential Eight | ISM-0445ISM-1175ISM-1380ISM-1387 | Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online…… | No mapping. Only shares CSF PR.AA-05: related, not a mapping+48 more loosely related (not mappings)ISM-1412 Web browsers are hardened using ASD and vendor hardening guidance, with the most… Only shares CSF PR.PS-01: related, not a mapping ISM-1485 Web browsers do not process web advertisements from the internet Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Only shares CSF PR.PS-01: related, not a mapping …and 44 more in the downloads | |
| DORA | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Governance Policy (editorial pick)17 loosely related (not mappings)…and 9 more in the downloads |
| CPS 234 | Para 18Para 19 | Maintain an information security policy framework; Policies direct everyone with security obligations | Editorial | Same topic: Governance Policy (editorial pick)6 loosely related (not mappings)Para 16 Assess third parties' information security capability Only shares CSF GV.SC-03: related, not a mapping Para 20 Classify information assets by criticality and sensitivity Only shares CSF ID.AM-08: related, not a mapping Para 22 Evaluate the design of third parties' controls Only shares CSF GV.SC-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.OC-03: related, not a mapping |
| Cyber Essentials | CE 4CE 2CE 1CE 3 | User Access Control; Secure Configuration… | No mapping. Only shares CSF PR.AA-01, PR.AA-05, PR.PS-01, ID.AM-03…: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.