NIST 800-53 r5 to HIPAA Security Rule crosswalk

29 control objectives in NIST SP 800-53 Security and Privacy Controls are mapped here to HIPAA Security Rule and Breach Notification Rule. 5 of them have no direct HIPAA Security Rule requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST 800-53 r5	HIPAA Security Rule
Security governance and policies	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures
Security roles and accountability	`PM-2`Information security program leadership role `AC-5`Separation of duties	`164.308(a)(2)`Assigned security responsibility
Risk assessment and treatment	`RA-3`Risk assessment `PM-9`Risk management strategy	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management
Asset and system inventory	`CM-8`System component inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)
Data classification and handling	`RA-2`Security categorization	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)
Access provisioning, review and removal	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management
Least privilege and privileged access	`AC-6`Least privilege `AC-5`Separation of duties	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management
Authentication, unique IDs and multi-factor authentication	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification
Encryption at rest and key management	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection	`164.312(a)(2)(iv)`Encryption and decryption (addressable)
Encryption in transit	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection	`164.312(e)(1)`Transmission security
Network security and segmentation	`SC-7`Boundary protection `AC-4`Information flow enforcement	no direct requirement
Secure configuration and hardening	`CM-2`Baseline configuration `CM-6`Configuration settings `CM-7`Least functionality	no direct requirement
Vulnerability scanning and patching	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation	`164.308(a)(8)`Evaluation (periodic technical evaluation)
Penetration testing and independent assessment	`CA-8`Penetration testing `CA-2`Control assessments	`164.308(a)(8)`Evaluation
Logging, log review and monitoring	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review
Intrusion detection and integrity monitoring	`SI-4`System monitoring `SI-7`Software, firmware and information integrity	`164.312(c)(1)`Integrity
Malware protection	`SI-3`Malicious code protection	`164.308(a)(5)(ii)(B)`Protection from malicious software
Incident response and breach notification	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)
Change management	`CM-3`Configuration change control `CM-4`Impact analyses `CM-5`Access restrictions for change	no direct requirement
Secure software development	`SA-3`System development life cycle `SA-8`Security and privacy engineering principles `SA-11`Developer testing and evaluation	no direct requirement
Third-party and vendor risk management	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements
Business continuity and disaster recovery	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution	`164.308(a)(7)`Contingency plan
Backup and redundancy	`CP-9`System backup	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan
Capacity and availability management	`SC-5`Denial-of-service protection	no direct requirement
Security awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training	`164.308(a)(5)`Security awareness and training
Personnel screening, terms and sanctions	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy
Physical access and facility security	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access	`164.310(a)`Facility access controls
Data retention, media handling and secure disposal	`MP-6`Media sanitization `SI-12`Information management and retention	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use
Ongoing control monitoring and internal audit	`CA-2`Control assessments `CA-7`Continuous monitoring	`164.308(a)(8)`Evaluation

Open a control objective for the evidence checklist.HIPAA Security Rule to NIST 800-53 r5 →

Scope: Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST 800-53 r5

NIST 800-53 r5 to SOC 2 NIST 800-53 r5 to PCI DSS 4.0 NIST 800-53 r5 to NIST CSF 2.0 NIST 800-53 r5 to ISO 27001:2022