HIPAA Security Rule to NIST CSF 2.0 crosswalk

24 control objectives in HIPAA Security Rule and Breach Notification Rule are mapped here to NIST Cybersecurity Framework. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	HIPAA Security Rule	NIST CSF 2.0
Security governance and policies	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures	`GV.PO`Policy `GV.OV`Oversight
Security roles and accountability	`164.308(a)(2)`Assigned security responsibility	`GV.RR`Roles, responsibilities and authorities
Risk assessment and treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management	`GV.RM`Risk management strategy `ID.RA`Risk assessment
Asset and system inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)	`ID.AM`Asset management
Data classification and handling	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security
Access provisioning, review and removal	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)
Least privilege and privileged access	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management	`PR.AA-05`Access permissions managed incorporating least privilege
Authentication, unique IDs and multi-factor authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification	`PR.AA-03`Users, services and hardware are authenticated
Encryption at rest and key management	`164.312(a)(2)(iv)`Encryption and decryption (addressable)	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected
Encryption in transit	`164.312(e)(1)`Transmission security	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected
Vulnerability scanning and patching	`164.308(a)(8)`Evaluation (periodic technical evaluation)	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk
Penetration testing and independent assessment	`164.308(a)(8)`Evaluation	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)
Logging, log review and monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring
Intrusion detection and integrity monitoring	`164.312(c)(1)`Integrity	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis
Malware protection	`164.308(a)(5)(ii)(B)`Protection from malicious software	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring
Incident response and breach notification	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis
Third-party and vendor risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements	`GV.SC`Cybersecurity supply chain risk management
Business continuity and disaster recovery	`164.308(a)(7)`Contingency plan	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution
Backup and redundancy	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan	`PR.DS-11`Backups of data are created, protected, maintained and tested
Security awareness and training	`164.308(a)(5)`Security awareness and training	`PR.AT`Awareness and training
Personnel screening, terms and sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy	`GV.RR-04`Cybersecurity is included in human resources practices
Physical access and facility security	`164.310(a)`Facility access controls	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk
Data retention, media handling and secure disposal	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles
Ongoing control monitoring and internal audit	`164.308(a)(8)`Evaluation	`ID.IM`Improvement `GV.OV`Oversight

Open a control objective for the evidence checklist.NIST CSF 2.0 to HIPAA Security Rule →

Scope: Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from HIPAA Security Rule

HIPAA Security Rule to SOC 2 HIPAA Security Rule to PCI DSS 4.0 HIPAA Security Rule to ISO 27001:2022 HIPAA Security Rule to NIST 800-53 r5