HIPAA Security Rule 164.308(a)(4)(ii)(A): Isolating Health Care Clearinghouse Functions (Required if applicable)

What else in your programme already covers this

This control maps to 49 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 5 controls

NIST800-AC-4 Information flow enforcement
NIST800-SC-3 Security Function Isolation. Isolate security functions from nonsecurity functions
NIST800-SC-32 System Partitioning. Partition the system into [organization-defined] residing in separate [organization-defined] domains or environments based on [organization-defined]
NIST800-SC-46 Cross Domain Policy Enforcement. Implement a policy enforcement mechanism [organization-defined] between the physical and/or network interfaces for the connecting security domains
NIST800-SC-7 Boundary protection

CIS Controls v8 · 4 controls

CIS-12.2 Establish and Maintain a Secure Network Architecture
CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work
CIS-13.4 Perform Traffic Filtering Between Network Segments
CIS-3.12 Segment Data Processing and Storage Based on Sensitivity

ISO 27701:2019 · 4 controls

6.10.1 Network security management
6.3.1 Internal organization
6.5.2 Information classification
6.6.2 User access management

SOC 2 · 4 controls

SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
SOC2-CC6.3 Role-based access and least privilege are enforced
SOC2-CC6.6 Measures against threats outside system boundaries are implemented

FedRAMP High · 3 controls

AC-4 Information Flow Enforcement
AC-4(21) Physical or Logical Separation of Information Flows
SC-7 Boundary Protection

FedRAMP Moderate · 3 controls

AC-4 Information Flow Enforcement
AC-4(21) Physical or Logical Separation of Information Flows
SC-7 Boundary Protection

NIST SP 800-171 Rev 3 · 3 controls

03.01.03 Information Flow Enforcement
03.13.01 Boundary Protection
03.13.04 Information in Shared System Resources

AWS Well-Architected Security Pillar · 2 controls

SEC01-BP01 Separate workloads using accounts
SEC05-BP01 Create network layers

Azure Security Benchmark · 2 controls

ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy
NS-1 Establish network segmentation boundaries

CMMC 2.0 · 2 controls

AC.L2-3.1.3 Control CUI Flow
SC.L2-3.13.5 Public-Access System Separation

NIST SP 800-172 · 2 controls

3.13.4e Physical and Logical Isolation Techniques
3.14.3e Include Systems in Scope of Enhanced Requirements or Segregate into Purpose-Specific Networks

NIST SP 800-53 Rev 5 MODERATE · 2 controls

AC-4 Information Flow Enforcement
SC-7 Boundary Protection

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

AC-4 Information Flow Enforcement
SC-7 Boundary Protection

PCI DSS 4.0 · 2 controls

1.4.1 NSCs between trusted and untrusted networks
2.2.3 Primary functions isolated or secured to highest level

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-22 Network segmentation (Excellent)

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP2 Step 2 - Define the boundaries of the CDR data environment

C5 (Germany) · 1 control

C5-OPS-24 Separation of Datasets in the Cloud Infrastructure

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-IVS-06 Segmentation and Segregation

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage

NIST SP 800-161 Rev 1 · 1 control

161R1-AC-4 Information Flow Enforcement

NIST SP 800-53 Rev 5 LOW · 1 control

SC-7 Boundary Protection

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.308(a)(4)(ii)(A) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gaps If you hold ISO 27002:202279.1% covered · 14 gaps If you hold FedRAMP Moderate77.6% covered · 15 gaps If you hold NIST SP 800-53 Rev 577.6% covered · 15 gaps If you hold C5 (Germany)76.1% covered · 16 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free