Perbandingan
NIST CSF 2.0 vs HIPAA Security Rule: memenuhi HIPAA dengan CSF
NIST Cybersecurity Framework 2.0 · HIPAA Security Rule · data 2026-10-27
Aturan Keamanan HIPAA (45 CFR Part 164, Subpart C) mewajibkan entitas tercakup dan mitra bisnis untuk melindungi informasi kesehatan terlindungi elektronik dengan pengamanan administratif, fisik, dan teknis. Sebagian spesifikasi implementasi bersifat wajib dan sebagian lainnya bersifat addressable. Office for Civil Rights (OCR) yang menegakkannya, dan analisis risiko menyeluruh menjadi intinya.
Panduan resmi NIST sendiri, SP 800-66 Rev 2, mengaitkan Aturan Keamanan dengan kontrol NIST, dan ControlMapping menggunakan Crosswalk HIPAA → SP 800-53 dari NIST untuk menautkan setiap persyaratan HIPAA ke hasil CSF. Dari CSF ke HIPAA, hampir setiap standar dan spesifikasi Aturan Keamanan dipetakan atau terkait secara longgar: program yang selaras dengan CSF sudah memenuhi sebagian besar yang diminta HIPAA.
Item HIPAA yang tersisa adalah kewajiban spesifik tanpa hasil CSF yang jelas, seperti ketentuan kontrak mitra bisnis dan penggunaan ulang media. Item tersebut merupakan persyaratan hukum dan kontraktual, bukan kontrol teknis.
Dari HIPAA ke CSF, CSF menuntut lebih dari HIPAA: hasil tata kelola seperti strategi risiko, ekspektasi pemangku kepentingan, dan manajemen risiko rantai pasok, verifikasi identitas, intelijen ancaman, serta pengembangan perangkat lunak yang aman. HHS mengusulkan pembaruan signifikan pada Aturan Keamanan pada Januari 2025; periksa aturan terkini sebelum mengandalkan perbedaan antara wajib dan addressable.
Poin utama
- Mulailah dengan analisis risiko yang terdokumentasi: itulah persyaratan HIPAA yang paling banyak menjadi fokus auditor dan investigasi OCR.
- CSF → HIPAA: tambahkan aspek hukum (perjanjian mitra bisnis, kebijakan, retensi dokumentasi).
- HIPAA di sini hanya mencakup Aturan Keamanan, bukan Aturan Privasi maupun Aturan Pemberitahuan Pelanggaran.
Miliki NIST CSF 2.0 → butuhkan HIPAA
69 persyaratan 38 terpetakan · · 2 tanpa pemetaan Buka di tampilan kesenjangan →Dari 69 persyaratan HIPAA Security Rule, 38 dipetakan ke sesuatu dalam NIST CSF 2.0, 29 hanya terkait secara longgar, dan 2 tidak memiliki pemetaan dalam data kami.
Hanya mencakup HIPAA Security Rule (tidak mencakup Privacy Rule atau Breach Notification Rule).
Kemungkinan pekerjaan baru: persyaratan HIPAA tanpa pemetaan ke NIST CSF 2.0 (2)
| HIPAA | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| §164.310 Physical safeguards · 1 | ||||
| §164.310(d)(2)(ii) | Required Media Re-use | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIST CSF 2.0 dalam data kami. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke NIST CSF 2.0 dalam data kami. |
Periksa ini: hanya terkait secara longgar (hasil CSF yang sama, bukan pemetaan) (29)
| HIPAA | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 11 | ||||
| §164.308(a)(1) | Security Management Process | GV.OC-03GV.OV-01GV.PO-01+2 | Hanya berbagi CSF GV.OC-03, GV.OV-01, GV.PO-01: terkait, bukan pemetaan | |
| §164.308(a)(3) | Workforce Security | DE.CM-01DE.CM-03GV.OC-03+5 | Hanya berbagi CSF DE.CM-01, DE.CM-03, GV.OC-03: terkait, bukan pemetaan | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | DE.CM-01DE.CM-03DE.CM-06+5 | Hanya berbagi CSF DE.CM-01, DE.CM-03, DE.CM-06: terkait, bukan pemetaan | |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | GV.OC-03GV.OV-01GV.PO-01+3 | Hanya berbagi CSF GV.OC-03, GV.OV-01, GV.PO-01: terkait, bukan pemetaan | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | ID.AM-03PR.AA-05PR.DS-01+2 | Hanya berbagi CSF ID.AM-03, PR.AA-05, PR.DS-01: terkait, bukan pemetaan | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | DE.CM-01DE.CM-03DE.CM-06+5 | Hanya berbagi CSF DE.CM-01, DE.CM-03, DE.CM-06: terkait, bukan pemetaan | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | DE.CM-01DE.CM-03GV.OC-03+5 | Hanya berbagi CSF DE.CM-01, DE.CM-03, GV.OC-03: terkait, bukan pemetaan | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | DE.AE-02DE.AE-03PR.AT-01+2 | Hanya berbagi CSF DE.AE-02, DE.AE-03, PR.AT-01: terkait, bukan pemetaan | |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | PR.AT-01PR.AT-02 | Hanya berbagi CSF PR.AT-01, PR.AT-02: terkait, bukan pemetaan | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | GV.OC-04ID.AM-05ID.RA-04+4 | Hanya berbagi CSF GV.OC-04, ID.AM-05, ID.RA-04: terkait, bukan pemetaan | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | DE.CM-06GV.OC-05GV.SC-04+5 | Hanya berbagi CSF DE.CM-06, GV.OC-05, GV.SC-04: terkait, bukan pemetaan | |
| §164.310 Physical safeguards · 2 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | DE.CM-02GV.OC-04PR.AA-06+5 | Hanya berbagi CSF DE.CM-02, GV.OC-04, PR.AA-06: terkait, bukan pemetaan | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | GV.OC-03GV.OV-01GV.PO-01+3 | Hanya berbagi CSF GV.OC-03, GV.OV-01, GV.PO-01: terkait, bukan pemetaan | |
| §164.312 Technical safeguards · 5 | ||||
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | DE.CM-01DE.CM-03GV.OC-04+5 | Hanya berbagi CSF DE.CM-01, DE.CM-03, GV.OC-04: terkait, bukan pemetaan | |
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | PR.AA-03 | Hanya berbagi CSF PR.AA-03: terkait, bukan pemetaan | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | DE.CM-09ID.RA-09PR.DS-01+3 | Hanya berbagi CSF DE.CM-09, ID.RA-09, PR.DS-01: terkait, bukan pemetaan | |
| §164.312(e)(1) | Transmission Security | PR.DS-02 | Hanya berbagi CSF PR.DS-02: terkait, bukan pemetaan | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | DE.CM-09ID.RA-09PR.DS-01+3 | Hanya berbagi CSF DE.CM-09, ID.RA-09, PR.DS-01: terkait, bukan pemetaan | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a)(2)(i) | Required Business Associate Contracts | DE.CM-06GV.OC-05GV.RR-04+5 | Hanya berbagi CSF DE.CM-06, GV.OC-05, GV.RR-04: terkait, bukan pemetaan | |
| §164.314(a)(2)(ii) | Required Other Arrangements | DE.CM-06GV.OC-05GV.RR-04+5 | Hanya berbagi CSF DE.CM-06, GV.OC-05, GV.RR-04: terkait, bukan pemetaan | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | DE.CM-06GV.OC-05GV.RR-04+5 | Hanya berbagi CSF DE.CM-06, GV.OC-05, GV.RR-04: terkait, bukan pemetaan | |
| §164.314(b) | Requirements for Group Health Plans | ID.AM-03ID.AM-08 | Hanya berbagi CSF ID.AM-03, ID.AM-08: terkait, bukan pemetaan | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | ID.AM-03ID.AM-08 | Hanya berbagi CSF ID.AM-03, ID.AM-08: terkait, bukan pemetaan | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | ID.AM-03ID.AM-08 | Hanya berbagi CSF ID.AM-03, ID.AM-08: terkait, bukan pemetaan | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | DE.CM-06GV.OC-05GV.SC-04+5 | Hanya berbagi CSF DE.CM-06, GV.OC-05, GV.SC-04: terkait, bukan pemetaan | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | RC.CO-03RS.AN-06RS.AN-07+5 | Hanya berbagi CSF RC.CO-03, RS.AN-06, RS.AN-07: terkait, bukan pemetaan | |
| §164.316 Policies and documentation · 3 | ||||
| §164.316(b) | Documentation | ID.AM-03ID.AM-08ID.RA-01 | Hanya berbagi CSF ID.AM-03, ID.AM-08, ID.RA-01: terkait, bukan pemetaan | |
| §164.316(b)(2)(i) | Required Time Limit | ID.AM-07ID.AM-08 | Hanya berbagi CSF ID.AM-07, ID.AM-08: terkait, bukan pemetaan | |
| §164.316(b)(2)(ii) | Required Availability | GV.OC-03GV.OV-01GV.PO-01+5 | Hanya berbagi CSF GV.OC-03, GV.OV-01, GV.PO-01: terkait, bukan pemetaan | |
Dipetakan (38)
| HIPAA | Persyaratan | Kecocokan | NIST CSF 2.0 | Bukti |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 19 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Crosswalk | ID.RA-03ID.RA-04ID.RA-05+3 | Topik sama: Penilaian Risiko |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | GV.RM-01GV.RM-02GV.RM-03+3 | Topik sama: Manajemen Risiko (pilihan editor) |
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | Editorial | DE.CM-03GV.RR-04 | Topik sama: Ancaman Orang Dalam (pilihan editor) |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Crosswalk | DE.AE-03DE.AE-06DE.AE-08+3 | Topik sama: SIEM / SOC |
| §164.308(a)(2) | Assigned Security Responsibility | Crosswalk | GV.RR-01GV.RR-02GV.RR-03 | Topik sama: Peran & Tanggung Jawab |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | Crosswalk | DE.CM-03GV.RR-04 | Topik sama: Ancaman Orang Dalam |
| §164.308(a)(4) | Information Access Management | Crosswalk | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses |
| §164.308(a)(5) | Security Awareness and Training | Crosswalk | PR.AT-01PR.AT-02 | Topik sama: Kesadaran & Pelatihan |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | Crosswalk | PR.AT-01PR.AT-02 | Topik sama: Kesadaran & Pelatihan |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | Editorial | DE.CM-09PR.PS-05 | Topik sama: Perlindungan Endpoint (pilihan editor) |
| §164.308(a)(6) | Security Incident Procedures | Crosswalk | ID.IM-04RS.MA-01RS.MA-02+2 | Topik sama: Respons Insiden |
| §164.308(a)(6)(ii) | Required Response and Reporting | Crosswalk | ID.IM-04RS.CO-02RS.MA-01+5 | Topik sama: Respons Insiden, Pelaporan |
| §164.308(a)(7) | Contingency Plan | Crosswalk | ID.IM-04RC.RP-01RC.RP-02 | Topik sama: Perencanaan Pemulihan |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Crosswalk | PR.DS-11RC.RP-03 | Topik sama: Cadangan & Pemulihan |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Crosswalk | ID.IM-04PR.IR-03RC.RP-01+2 | Topik sama: Perencanaan Pemulihan, Pemulihan Bencana |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | Crosswalk | GV.OC-04PR.IR-03RC.RP-04 | Topik sama: Kelangsungan Usaha |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | Editorial | PR.IR-03RC.RP-02RC.RP-05 | Topik sama: Pemulihan Bencana (pilihan editor) |
| §164.308(a)(8) | Evaluation | Crosswalk | ID.RA-01ID.RA-08GV.OC-03+1 | Topik sama: Manajemen Kerentanan, Kepatuhan |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+5 | Topik sama: Manajemen Risiko Vendor |
| §164.310 Physical safeguards · 9 | ||||
| §164.310(a) | Facility Access Controls | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | Editorial | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik (pilihan editor) |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| §164.310(b) | Workstation Use | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| §164.310(c) | Workstation Security | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Topik sama: Keamanan Fisik |
| §164.310(d) | Device and Media Controls | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+3 | Topik sama: Manajemen Aset |
| §164.310(d)(2)(i) | Required Disposal | Editorial | PR.DS-01PR.DS-02PR.DS-10 | Topik sama: Perlindungan Data (pilihan editor) |
| §164.310(d)(2)(iii) | Addressable Accountability | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+1 | Topik sama: Manajemen Aset |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Crosswalk | PR.DS-11RC.RP-03 | Topik sama: Cadangan & Pemulihan |
| §164.312 Technical safeguards · 7 | ||||
| §164.312(a) | Access Control | Crosswalk | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses |
| §164.312(a)(2)(i) | Required Unique User Identification | Crosswalk | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | Crosswalk | PR.DS-01PR.DS-02 | Topik sama: Enkripsi |
| §164.312(b) | Audit Controls | Crosswalk | DE.AE-03PR.PS-04 | Topik sama: Pencatatan & Audit |
| §164.312(c) | Integrity | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Topik sama: Perlindungan Data |
| §164.312(d) | Person or Entity Authentication | Editorial | PR.AA-01PR.AA-05 | Topik sama: Kontrol Akses (pilihan editor) |
| §164.312(e)(2)(ii) | Addressable Encryption | Crosswalk | PR.DS-01PR.DS-02 | Topik sama: Enkripsi |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+2 | Topik sama: Manajemen Risiko Vendor |
| §164.316 Policies and documentation · 2 | ||||
| §164.316(a) | Policies and Procedures | Crosswalk | GV.PO-01GV.PO-02 | Topik sama: Kebijakan Tata Kelola |
| §164.316(b)(2)(iii) | Required Updates | Crosswalk | GV.PO-01GV.PO-02 | Topik sama: Kebijakan Tata Kelola |
Miliki HIPAA → butuhkan NIST CSF 2.0
106 persyaratan 63 terpetakan · · 16 tanpa pemetaan Buka di tampilan kesenjangan →Dari 106 persyaratan NIST Cybersecurity Framework 2.0, 63 dipetakan ke sesuatu dalam HIPAA, 27 hanya terkait secara longgar, dan 16 tidak memiliki pemetaan dalam data kami.
Kemungkinan pekerjaan baru: persyaratan NIST CSF 2.0 tanpa pemetaan ke HIPAA (16)
| NIST CSF 2.0 | Persyaratan | Kecocokan | HIPAA | Bukti |
|---|---|---|---|---|
| Detect (DE) · 1 | ||||
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| Govern (GV) · 7 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| Identify (ID) · 4 | ||||
| ID.IM-01 | Improvements are identified from evaluations | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| Protect (PR) · 4 | ||||
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Tidak ada pemetaan dalam data kami | — | Tidak ada pemetaan ke HIPAA dalam data kami. |
Periksa ini: hanya terkait secara longgar (hasil CSF yang sama, bukan pemetaan) (27)
| NIST CSF 2.0 | Persyaratan | Kecocokan | HIPAA | Bukti |
|---|---|---|---|---|
| Detect (DE) · 2 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | §164.308(a)(1)(ii)(D)§164.308(a)(5)(ii)(C)§164.308(a)(6)+3 | Hanya berbagi CSF DE.AE-02: terkait, bukan pemetaan | |
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Hanya berbagi CSF DE.AE-07: terkait, bukan pemetaan | |
| Govern (GV) · 8 | ||||
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | §164.308(b)(1)§164.308(b)(4)§164.314(a)+4 | Hanya berbagi CSF GV.OC-05: terkait, bukan pemetaan | |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | §164.308(a)(1)§164.308(a)(3)§164.308(a)(3)(ii)(A)+5 | Hanya berbagi CSF GV.OV-01: terkait, bukan pemetaan | |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Hanya berbagi CSF GV.RM-07: terkait, bukan pemetaan | |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | §164.308(a)(1)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)+5 | Hanya berbagi CSF GV.SC-03: terkait, bukan pemetaan | |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | §164.308(b)(1)§164.308(b)(4)§164.314(a)+4 | Hanya berbagi CSF GV.SC-05: terkait, bukan pemetaan | |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | §164.308(a)(6)§164.308(a)(7)§164.308(b)(1)+5 | Hanya berbagi CSF GV.SC-08: terkait, bukan pemetaan | |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(b)(1)+5 | Hanya berbagi CSF GV.SC-09: terkait, bukan pemetaan | |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(b)(1)+5 | Hanya berbagi CSF GV.SC-10: terkait, bukan pemetaan | |
| Identify (ID) · 5 | ||||
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | §164.308(a)(1)(ii)(B)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(A)+5 | Hanya berbagi CSF ID.AM-03: terkait, bukan pemetaan | |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(7)(ii)(E)+1 | Hanya berbagi CSF ID.AM-05: terkait, bukan pemetaan | |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | §164.316(b)(2)(i) | Hanya berbagi CSF ID.AM-07: terkait, bukan pemetaan | |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | §164.308(a)(1)(ii)(D)§164.308(a)(8) | Hanya berbagi CSF ID.RA-07: terkait, bukan pemetaan | |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | §164.308(b)(4)§164.312(c)§164.312(c)(2)+4 | Hanya berbagi CSF ID.RA-09: terkait, bukan pemetaan | |
| Protect (PR) · 3 | ||||
| PR.AA-03 | Users, services, and hardware are authenticated | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)+1 | Hanya berbagi CSF PR.AA-03: terkait, bukan pemetaan | |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | §164.308(a)(7)(ii)(A)§164.308(a)(7)(ii)(B)§164.310(a)(2)(i) | Hanya berbagi CSF PR.IR-04: terkait, bukan pemetaan | |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | §164.312(c)§164.312(c)(2)§164.312(e)(2)(i) | Hanya berbagi CSF PR.PS-02: terkait, bukan pemetaan | |
| Recover (RC) · 3 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+3 | Hanya berbagi CSF RC.CO-03: terkait, bukan pemetaan | |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)+5 | Hanya berbagi CSF RC.CO-04: terkait, bukan pemetaan | |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | §164.308(a)(6)§164.308(a)(6)(ii) | Hanya berbagi CSF RC.RP-06: terkait, bukan pemetaan | |
| Respond (RS) · 6 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+1 | Hanya berbagi CSF RS.AN-03: terkait, bukan pemetaan | |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+4 | Hanya berbagi CSF RS.AN-06: terkait, bukan pemetaan | |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+4 | Hanya berbagi CSF RS.AN-07: terkait, bukan pemetaan | |
| RS.AN-08 | An incident's magnitude is estimated and validated | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(6)+2 | Hanya berbagi CSF RS.AN-08: terkait, bukan pemetaan | |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)+3 | Hanya berbagi CSF RS.CO-03: terkait, bukan pemetaan | |
| RS.MA-05 | The criteria for initiating incident recovery are applied | §164.308(a)(6)§164.308(a)(6)(ii) | Hanya berbagi CSF RS.MA-05: terkait, bukan pemetaan | |
Dipetakan (63)
| NIST CSF 2.0 | Persyaratan | Kecocokan | HIPAA | Bukti |
|---|---|---|---|---|
| Detect (DE) · 8 | ||||
| DE.AE-03 | Information is correlated from multiple sources | Crosswalk | §164.308(a)(1)(ii)(D)§164.312(b) | Topik sama: SIEM / SOC, Pencatatan & Audit |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Crosswalk | §164.308(a)(1)(ii)(D) | Topik sama: SIEM / SOC |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Crosswalk | §164.308(a)(1)(ii)(D) | Topik sama: SIEM / SOC |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D) | Topik sama: Pemantauan Berkelanjutan |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Topik sama: Keamanan Fisik |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D)§164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Topik sama: Pemantauan Berkelanjutan, Ancaman Orang Dalam |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Crosswalk | §164.308(b)(1)§164.314(a) | Topik sama: Manajemen Risiko Vendor |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Crosswalk | §164.308(a)(1)(ii)(D)§164.308(a)(5)(ii)(B) | Topik sama: Pemantauan Berkelanjutan, Perlindungan Endpoint |
| Govern (GV) · 16 | ||||
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Editorial | §164.308(a)(8) | Topik sama: Kepatuhan (pilihan editor) |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Crosswalk | §164.308(a)(7)(ii)(C) | Topik sama: Kelangsungan Usaha |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | §164.308(a)(8) | Topik sama: Kepatuhan (pilihan editor) |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Crosswalk | §164.316(a)§164.316(b)(2)(iii) | Topik sama: Kebijakan Tata Kelola |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | §164.316(a)§164.316(b)(2)(iii) | Topik sama: Kebijakan Tata Kelola |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Editorial | §164.308(a)(1)(ii)(B) | Topik sama: Manajemen Risiko (pilihan editor) |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Editorial | §164.308(a)(1)(ii)(B) | Topik sama: Manajemen Risiko (pilihan editor) |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Editorial | §164.308(a)(1)(ii)(B) | Topik sama: Manajemen Risiko (pilihan editor) |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Editorial | §164.308(a)(1)(ii)(B) | Topik sama: Manajemen Risiko (pilihan editor) |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Crosswalk | §164.308(a)(2) | Topik sama: Peran & Tanggung Jawab |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Crosswalk | §164.308(a)(2) | Topik sama: Peran & Tanggung Jawab |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Crosswalk | §164.308(a)(2) | Topik sama: Peran & Tanggung Jawab |
| GV.RR-04 | Cybersecurity is included in human resources practices | Crosswalk | §164.308(a)(3)(ii)(B)§164.308(a)(1)(ii)(C) | Topik sama: Ancaman Orang Dalam |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Crosswalk | §164.308(b)(1)§164.314(a) | Topik sama: Manajemen Risiko Vendor |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Crosswalk | §164.308(b)(1)§164.314(a) | Topik sama: Manajemen Risiko Vendor |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Crosswalk | §164.308(b)(1)§164.314(a) | Topik sama: Manajemen Risiko Vendor |
| Identify (ID) · 12 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Topik sama: Manajemen Aset |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Topik sama: Manajemen Aset |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Crosswalk | §164.308(b)(1)§164.310(d)§164.310(d)(2)(iii) | Topik sama: Keamanan Cloud, Manajemen Aset |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Crosswalk | §164.310(d)§164.310(d)(2)(iii) | Topik sama: Manajemen Aset |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)+1 | Topik sama: Respons Insiden, Perencanaan Pemulihan |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Topik sama: Manajemen Kerentanan |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Crosswalk | §164.308(a)(1)(ii)(A) | Topik sama: Penilaian Risiko |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Crosswalk | §164.308(a)(1)(ii)(A) | Topik sama: Penilaian Risiko |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Crosswalk | §164.308(a)(1)(ii)(A) | Topik sama: Penilaian Risiko |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Crosswalk | §164.308(a)(1)(ii)(A) | Topik sama: Penilaian Risiko |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Topik sama: Manajemen Kerentanan |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Crosswalk | §164.308(b)(1)§164.314(a) | Topik sama: Manajemen Risiko Vendor |
| Protect (PR) · 15 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+1 | Topik sama: Kontrol Akses |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Crosswalk | §164.308(a)(4)§164.312(a)§164.312(a)(2)(i)+2 | Topik sama: Kontrol Akses |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Topik sama: Keamanan Fisik |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Topik sama: Kesadaran & Pelatihan |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Crosswalk | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Topik sama: Kesadaran & Pelatihan |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Crosswalk | §164.312(a)(2)(iv)§164.312(c)§164.312(e)(2)(ii)+1 | Topik sama: Enkripsi, Perlindungan Data |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Crosswalk | §164.312(a)(2)(iv)§164.312(c)§164.312(e)(2)(ii)+1 | Topik sama: Enkripsi, Perlindungan Data |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Crosswalk | §164.312(c)§164.310(d)(2)(i) | Topik sama: Perlindungan Data |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Crosswalk | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Topik sama: Cadangan & Pemulihan |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | Crosswalk | §164.308(b)(1) | Topik sama: Keamanan Cloud |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | Crosswalk | §164.310(a)§164.310(a)(2)(iii)§164.310(b)+2 | Topik sama: Keamanan Fisik |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Crosswalk | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D) | Topik sama: Pemulihan Bencana, Kelangsungan Usaha |
| PR.PS-01 | Configuration management practices are established and applied | Crosswalk | §164.308(b)(1)§164.310(d) | Topik sama: Keamanan Cloud, Keamanan Seluler |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Crosswalk | §164.312(b) | Topik sama: Pencatatan & Audit |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | Editorial | §164.308(a)(5)(ii)(B) | Topik sama: Perlindungan Endpoint (pilihan editor) |
| Recover (RC) · 5 | ||||
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | Crosswalk | §164.308(a)(7)§164.308(a)(7)(ii)(B) | Topik sama: Perencanaan Pemulihan |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Crosswalk | §164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D) | Topik sama: Perencanaan Pemulihan, Pemulihan Bencana |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Crosswalk | §164.308(a)(7)(ii)(A)§164.310(d)(2)(iv) | Topik sama: Cadangan & Pemulihan |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Crosswalk | §164.308(a)(7)(ii)(C) | Topik sama: Kelangsungan Usaha |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Crosswalk | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D) | Topik sama: Pemulihan Bencana |
| Respond (RS) · 7 | ||||
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Crosswalk | §164.308(a)(6)(ii) | Topik sama: Pelaporan |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Topik sama: Respons Insiden |
| RS.MA-02 | Incident reports are triaged and validated | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Topik sama: Respons Insiden |
| RS.MA-03 | Incidents are categorized and prioritized | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Topik sama: Respons Insiden |
| RS.MA-04 | Incidents are escalated or elevated as needed | Crosswalk | §164.308(a)(6)§164.308(a)(6)(ii) | Topik sama: Respons Insiden |
| RS.MI-01 | Incidents are contained | Crosswalk | §164.308(a)(6)(ii) | Topik sama: Mitigasi |
| RS.MI-02 | Incidents are eradicated | Crosswalk | §164.308(a)(6)(ii) | Topik sama: Mitigasi |
Menurut topik
Keduanya mencakup (27):
Kebijakan Tata KelolaKesadaran & PelatihanManajemen RisikoPeran & Tanggung JawabKepatuhanManajemen AsetPenilaian RisikoManajemen KerentananKontrol AksesEnkripsiPerlindungan DataCadangan & PemulihanPerlindungan EndpointKeamanan SelulerKeamanan CloudPemantauan BerkelanjutanPencatatan & AuditSIEM / SOCRespons InsidenMitigasiPelaporanPerencanaan PemulihanKelangsungan UsahaPemulihan BencanaAncaman Orang DalamManajemen Risiko VendorKeamanan Fisik
Hanya NIST CSF 2.0 (23):
Risiko Rantai PasokLingkungan BisnisKlasifikasi DataIntelijen AncamanAutentikasi Multi-FaktorAkses IstimewaFirewall / Segmentasi JaringanManajemen PatchKonfigurasi AmanPengembangan AmanKeamanan EmailKeamanan WebZero TrustKeamanan DNSWAFDLPDeteksi IntrusiDeteksi AnomaliForensikKomunikasiPelajaran yang DipetikKomunikasi & PemulihanKeamanan API
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Crosswalk crosswalk yang dipublikasikan (NIST, ENISA, CIS, PCI SSC) menetapkan tautannya · Editorial Penilaian ControlMapping jika tidak ada crosswalk; alasannya ditampilkan · hanya berbagi hasil CSF 2.0: layak diperiksa, bukan pemetaan · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Dipetakan = dikurasi bersama dalam topik ControlMapping, atau ditautkan langsung. Crosswalk tidak membuktikan kepatuhan. Metodologi · Unduh data · Laporkan kesalahan.