HIPAA Security Rule 164.308(a)(3)(ii)(A): Authorization and Supervision (Addressable)

What else in your programme already covers this

This control maps to 59 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 5 controls

5.18 Access rights
5.2 Information security roles and responsibilities
5.4 Management responsibilities
6.1 Screening
8.2 Privileged access rights

ISO 27002:2022 · 5 controls

5.18 Access rights
5.2 Information security roles and responsibilities
5.4 Management responsibilities
6.1 Screening
6.2 Terms and conditions of employment

NIST SP 800-53 Rev 5 · 5 controls

NIST800-AC-2 AC-2 Account Management
NIST800-CA-6 CA-6 Authorization
NIST800-PM-10 PM-10 Authorization Process
NIST800-PS-1 PS-1 Policy and Procedures
NIST800-PS-7 PS-7 External Personnel Security

PCI DSS 4.0 · 5 controls

7.2.3 7.2.3 Privileges approved by authorized personnel
8.2.4 8.2.4 User ID lifecycle changes authorized
9.3.2 9.3.2 Visitor access procedures for the CDE
7.2.4 7.2.4 User accounts and privileges reviewed every six months
7.3.1 7.3.1 Need-to-know access control system covers all components

Azure Security Benchmark · 4 controls

ASBv3-IM-2 Protect identity and authentication systems
ASBv3-PA-7 Follow just enough administration (least privilege) principle
PA-1 Separate and limit highly privileged/administrative users
PA-2 Avoid standing access for user accounts and permissions

AWS Well-Architected Security Pillar · 3 controls

SEC01-BP02 Secure account root user and properties
SEC03-BP01 Define access requirements
SEC06-BP03 Reduce manual management and interactive access

C5 (Germany) · 3 controls

C5-HR-02 Employment terms and conditions
C5-IDM-02 Granting and change of user accounts and access rights
C5-IDM-06 Privileged access rights

SOC 2 · 3 controls

SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-05 Maintain an Exhaustive Inventory of Privileged Accounts
ANSSI-HYG-09 Assign the Correct Rights on Sensitive Resources

Australia My Health Records Act 2012 · 2 controls

MYHR-SEC-2 Access controls and user account management
MYHR-SEC-3 Audit logging and access monitoring

CMMC 2.0 · 2 controls

AC.L2-3.1.1 Authorized Access Control
AC.L2-3.1.5 Least Privilege

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-HRS-09 Personnel Roles and Responsibilities
CCM-IAM-06 User Access Provisioning

FedRAMP High · 2 controls

AC-2 Account Management
AC-6 Least Privilege

FedRAMP Moderate · 2 controls

AC-2 Account Management
AC-6 Least Privilege

NIST SP 800-161 Rev 1 · 2 controls

161R1-MA-5 Maintenance Personnel
161R1-PS-6 Access Agreements

NIST SP 800-171 Rev 3 · 2 controls

03.01.01 Account Management
03.01.05 Least Privilege

UK Cyber Essentials · 2 controls

CE-AC.1 User Account Approval Process
CE-AC.5 Separate Admin Accounts for Administrative Activities

ACSC Essential Eight · 1 control

E8-ADMIN-ML1 Restrict Administrative Privileges (ML1)

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-29 Employee security awareness

APPI · 1 control

APPI-A24 Supervision of Employees

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-18 Restrict administrative privileges (Essential)

CIS Controls v8 · 1 control

CIS-6.1 Establish an Access Granting Process

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-172 · 1 control

3.1.1e Dual Authorization for Sensitive System Operations

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.308(a)(3)(ii)(A) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gaps If you hold ISO 27002:202279.1% covered · 14 gaps If you hold FedRAMP Moderate77.6% covered · 15 gaps If you hold NIST SP 800-53 Rev 577.6% covered · 15 gaps If you hold C5 (Germany)76.1% covered · 16 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free