Documentation

frameworkHIPAA Security Rule section§164.316 Policies and documentation csf 2.0ID.AM-03 ID.AM-08 ID.IM-01 ID.IM-02 ID.IM-03 ID.IM-04 ID.RA-01 topics— frameworks1 0 0

Official text(i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and (ii) if an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.316(b) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 ID.AM-08 ID.RA-01	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.RA-01: related, not a mapping
ISO 27001	A.5.19 A.5.8 A.5.9 A.5.11	Information security in supplier relationships; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.IM-02: related, not a mapping +11 more loosely related (not mappings) A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.5 CIS 3.8 CIS 7.1	Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03, ID.RA-01: related, not a mapping +23 more loosely related (not mappings) CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 19 more in the downloads
SOC 2	CC6.1 CC6.6 CC7.1	Logical access security over information assets; Protection against threats from outside system boundaries…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-03, ID.RA-01: related, not a mapping
PCI DSS	6.3.1 6.3.3 11.3.1 11.3.2	Vulnerabilities identified and risk-ranked; Security patches installed promptly…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01, ID.IM-03: related, not a mapping +15 more loosely related (not mappings) 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF ID.IM-02, ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Loosely related Only shares CSF ID.AM-08, ID.IM-01: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 11 more in the downloads
CMMC	CA.L2-3.12.4 CA.L2-3.12.1 CA.L2-3.12.3 CM.L2-3.4.9	System Security Plan; Security Control Assessment…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.IM-01, ID.IM-02…: related, not a mapping +9 more loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.2 Vulnerability Scan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA.L2-3.11.3 Vulnerability Remediation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 5 more in the downloads
800-53	CA-2 PL-2	Control Assessments; System Security and Privacy Plans	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 27 loosely related (not mappings) CA-7 Continuous Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA-8 Penetration Testing Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping RA-5 Vulnerability Monitoring and Scanning Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SA-8 Security and Privacy Engineering Principles Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping SA-11 Developer Testing and Evaluation Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03: related, not a mapping …and 19 more in the downloads
GDPR	Art.30(1)Art.32(1)(d)	Records of processing activities; Security of processing	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping
NIS2	12.4 2.1 4.3 6.2	Asset inventory; Risk management framework…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-08, ID.RA-01: related, not a mapping +2 more loosely related (not mappings) 6.5 Security testing Loosely related Only shares CSF ID.RA-01: related, not a mapping 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-01: related, not a mapping
Essential Eight	ISM-1807 ISM-0304 ISM-1407 ISM-1501	An automated method of asset discovery is used at least fortnightly to support the…; Applications other than office productivity suites, web browsers and their extensions……	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping +25 more loosely related (not mappings) ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Loosely related Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Loosely related Only shares CSF ID.RA-01: related, not a mapping …and 21 more in the downloads
DORA	Art.8(1)Art.8(2)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01: related, not a mapping +4 more loosely related (not mappings) Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03: related, not a mapping Art.25(1) Testing of ICT tools and systems Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.26(1) Advanced testing of ICT tools, systems and processes based on TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping Art.27(1) Requirements for testers for the carrying out of TLPT Loosely related Only shares CSF ID.RA-01: related, not a mapping
CPS 234	Para 17 Para 20 Para 27 Para 30	Keep capability current as threats and vulnerabilities change; Classify information assets by criticality and sensitivity…	Loosely related	No mapping. Only shares CSF ID.RA-01, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3 CE 1	Security Update Management; Firewalls	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.RA-01, ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.