SOC 2 to HIPAA Security Rule crosswalk

29 control objectives in SOC 2 Trust Services Criteria are mapped here to HIPAA Security Rule and Breach Notification Rule. 5 of them have no direct HIPAA Security Rule requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	SOC 2	HIPAA Security Rule
Security governance and policies	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures
Security roles and accountability	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability	`164.308(a)(2)`Assigned security responsibility
Risk assessment and treatment	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management
Asset and system inventory	`CC6.1`Logical access security (inventory of information assets is a point of focus)	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)
Data classification and handling	`C1.1`Identifies and maintains confidential information	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)
Access provisioning, review and removal	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management
Least privilege and privileged access	`CC6.3`Role-based access and least privilege	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management
Authentication, unique IDs and multi-factor authentication	`CC6.1`Logical access security software, infrastructure and architectures	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification
Encryption at rest and key management	`CC6.1`Logical access security (encryption of data at rest)	`164.312(a)(2)(iv)`Encryption and decryption (addressable)
Encryption in transit	`CC6.7`Restricts transmission, movement and removal of information	`164.312(e)(1)`Transmission security
Network security and segmentation	`CC6.6`Implements logical access security measures against threats from outside system boundaries	no direct requirement
Secure configuration and hardening	`CC7.1`Uses detection and monitoring procedures to identify changes to configurations	no direct requirement
Vulnerability scanning and patching	`CC7.1`Detection and monitoring procedures identify vulnerabilities	`164.308(a)(8)`Evaluation (periodic technical evaluation)
Penetration testing and independent assessment	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures	`164.308(a)(8)`Evaluation
Logging, log review and monitoring	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review
Intrusion detection and integrity monitoring	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software	`164.312(c)(1)`Integrity
Malware protection	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software	`164.308(a)(5)(ii)(B)`Protection from malicious software
Incident response and breach notification	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)
Change management	`CC8.1`Authorizes, designs, develops, configures, documents, tests, approves and implements changes	no direct requirement
Secure software development	`CC8.1`Changes are developed, tested and approved	no direct requirement
Third-party and vendor risk management	`CC9.2`Assesses and manages risks associated with vendors and business partners	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements
Business continuity and disaster recovery	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures	`164.308(a)(7)`Contingency plan
Backup and redundancy	`A1.2`Data backup processes and recovery infrastructure	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan
Capacity and availability management	`A1.1`Maintains, monitors and evaluates current processing capacity	no direct requirement
Security awareness and training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control	`164.308(a)(5)`Security awareness and training
Personnel screening, terms and sanctions	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy
Physical access and facility security	`CC6.4`Restricts physical access to facilities and protected information assets	`164.310(a)`Facility access controls
Data retention, media handling and secure disposal	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use
Ongoing control monitoring and internal audit	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies	`164.308(a)(8)`Evaluation

Open a control objective for the evidence checklist.HIPAA Security Rule to SOC 2 →

Scope: Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

SOC 2 to HIPAA Security Rule crosswalk

More from SOC 2