Australia My Health Records Act 2012
Security and Access

Australia My Health Records Act 2012 MYHR-SEC-4: Training of authorised employees

Train authorised employees on their obligations and the secure use of the My Health Record system before access and on an ongoing basis.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 41 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

FedRAMP High · 4 controls

  • AT-1 Policy and Procedures
  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • AT-4 Training Records

FedRAMP Moderate · 4 controls

  • AT-1 Policy and Procedures
  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • AT-4 Training Records

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.RR-04 Cybersecurity is included in human resources practices
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

NIST SP 800-53 Rev 5 · 4 controls

C5 (Germany) · 3 controls

  • C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets
  • C5-HR-02 Employment terms and conditions
  • C5-HR-03 Security training and awareness programme

CIS Controls v8 · 3 controls

  • CIS-14.1 Establish and Maintain a Security Awareness Program
  • CIS-14.4 Train Workforce on Data Handling Best Practices
  • CIS-14.6 Train Workforce Members on Recognizing and Reporting Security Incidents

APEC Cross-Border Privacy Rules (CBPR) System · 2 controls

GDPR · 2 controls

  • GDPR-Art.29 Processing under the authority of the controller or processor
  • GDPR-Art.39 Tasks of the data protection officer

HIPAA Security Rule · 2 controls

NIST SP 800-161 Rev 1 · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

APPI · 1 control

APRA CPS 234 · 1 control

  • CPS234-P19 Policy Direction to All Responsible Parties

ISO 27001:2022 · 1 control

  • 6.3 Information security awareness, education and training

ISO 27002:2022 · 1 control

  • 6.3 Information security awareness, education and training

SOC 2 · 1 control

  • SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Security and Access

You are reading one control. How much of Australia My Health Records Act 2012 have you already done?

Australia My Health Records Act 2012 MYHR-SEC-4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Australia My Health Records Act 2012 your existing evidence covers. Hold FedRAMP Moderate and 9 of 40 Australia My Health Records Act 2012 controls already carry evidence.

If you hold FedRAMP Moderate22.5% covered · 31 gapsIf you hold C5 (Germany)20% covered · 32 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.120% covered · 32 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the FedRAMP Moderate pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 41 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Australia My Health Records Act 2012 controls