NIST CSF 2.0 to HIPAA Security Rule crosswalk

29 control objectives in NIST Cybersecurity Framework are mapped here to HIPAA Security Rule and Breach Notification Rule. 5 of them have no direct HIPAA Security Rule requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	NIST CSF 2.0	HIPAA Security Rule
Security governance and policies	`GV.PO`Policy `GV.OV`Oversight	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures
Security roles and accountability	`GV.RR`Roles, responsibilities and authorities	`164.308(a)(2)`Assigned security responsibility
Risk assessment and treatment	`GV.RM`Risk management strategy `ID.RA`Risk assessment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management
Asset and system inventory	`ID.AM`Asset management	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)
Data classification and handling	`ID.AM-07`Inventories of data and corresponding metadata are maintained `PR.DS`Data security	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)
Access provisioning, review and removal	`PR.AA-05`Access permissions, entitlements and authorizations are defined and managed (least privilege, separation of duties)	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management
Least privilege and privileged access	`PR.AA-05`Access permissions managed incorporating least privilege	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management
Authentication, unique IDs and multi-factor authentication	`PR.AA-03`Users, services and hardware are authenticated	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification
Encryption at rest and key management	`PR.DS-01`The confidentiality, integrity and availability of data-at-rest are protected	`164.312(a)(2)(iv)`Encryption and decryption (addressable)
Encryption in transit	`PR.DS-02`The confidentiality, integrity and availability of data-in-transit are protected	`164.312(e)(1)`Transmission security
Network security and segmentation	`PR.IR-01`Networks and environments are protected from unauthorized logical access and usage	no direct requirement
Secure configuration and hardening	`PR.PS-01`Configuration management practices are established and applied	no direct requirement
Vulnerability scanning and patching	`ID.RA`Risk assessment (vulnerability identification, ID.RA-01) `PR.PS-02`Software is maintained, replaced and removed commensurate with risk	`164.308(a)(8)`Evaluation (periodic technical evaluation)
Penetration testing and independent assessment	`ID.IM`Improvement (incl. ID.IM-02, improvements from tests and exercises)	`164.308(a)(8)`Evaluation
Logging, log review and monitoring	`DE.CM`Continuous monitoring `PR.PS-04`Log records are generated and made available for continuous monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review
Intrusion detection and integrity monitoring	`DE.CM`Continuous monitoring `DE.AE`Adverse event analysis	`164.312(c)(1)`Integrity
Malware protection	`PR.PS-05`Installation and execution of unauthorized software are prevented `DE.CM`Continuous monitoring	`164.308(a)(5)(ii)(B)`Protection from malicious software
Incident response and breach notification	`RS.MA`Incident management `RS.AN`Incident analysis `RS.CO`Incident response reporting and communication `RS.MI`Incident mitigation `DE.AE`Adverse event analysis	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)
Change management	`PR.PS-01`Configuration management practices are established and applied	no direct requirement
Secure software development	`PR.PS-06`Secure software development practices are integrated and their performance monitored	no direct requirement
Third-party and vendor risk management	`GV.SC`Cybersecurity supply chain risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements
Business continuity and disaster recovery	`PR.IR-03`Mechanisms are implemented to achieve resilience requirements `RC.RP`Incident recovery plan execution	`164.308(a)(7)`Contingency plan
Backup and redundancy	`PR.DS-11`Backups of data are created, protected, maintained and tested	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan
Capacity and availability management	`PR.IR-04`Adequate resource capacity to ensure availability is maintained	no direct requirement
Security awareness and training	`PR.AT`Awareness and training	`164.308(a)(5)`Security awareness and training
Personnel screening, terms and sanctions	`GV.RR-04`Cybersecurity is included in human resources practices	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy
Physical access and facility security	`PR.AA-06`Physical access to assets is managed, monitored and enforced commensurate with risk	`164.310(a)`Facility access controls
Data retention, media handling and secure disposal	`ID.AM-08`Systems, hardware, software, services and data are managed throughout their life cycles	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use
Ongoing control monitoring and internal audit	`ID.IM`Improvement `GV.OV`Oversight	`164.308(a)(8)`Evaluation

Open a control objective for the evidence checklist.HIPAA Security Rule to NIST CSF 2.0 →

Scope: Mapped at category level (e.g. PR.AA) or subcategory where one is clearly the match (e.g. PR.AA-05). Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from NIST CSF 2.0

NIST CSF 2.0 to SOC 2 NIST CSF 2.0 to PCI DSS 4.0 NIST CSF 2.0 to ISO 27001:2022 NIST CSF 2.0 to NIST 800-53 r5