HIPAA Security Rule
Administrative

HIPAA Security Rule 164.308(a)(6)(i): Security Incident Procedures (Standard)

Implement policies to address security incidents. NIST recommends an incident response plan aligned to NIST SP 800-61 with detection, analysis, containment, eradication, and recovery phases.

What else in your programme already covers this

This control maps to 82 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 7 controls

  • NIST800-AC-23 Data Mining Protection. Employ [organization-defined] for [organization-defined] to detect and protect against unauthorized data mining
  • NIST800-IR-1 Policy and procedures for incident response
  • NIST800-IR-3 Incident response testing
  • NIST800-IR-4 Incident handling
  • NIST800-IR-8 Incident response plan
  • NIST800-PM-16 Threat Awareness Program. Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence
  • NIST800-SI-5 Security alerts, advisories, and directives

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
  • NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
  • NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated
  • NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
  • NIST-CSF-RS.MA-02 Incident reports are triaged and validated

CIS Controls v8 · 5 controls

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution
  • CIS-14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
  • CIS-17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
  • CIS-17.4 Establish and Maintain an Incident Response Process
  • CIS-17.5 Assign Key Roles and Responsibilities

ISO 22301:2019 · 5 controls

  • 6.1.2 Addressing risks and opportunities
  • 8.2.3 Risk assessment
  • 8.4.1 General
  • 8.4.2 Response structure
  • 8.4.4 Business continuity plans

PCI DSS 4.0 · 5 controls

  • 11.2.1 Wireless AP detection
  • 12.10.1 Incident response plan
  • 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application
  • 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applications and is configured
  • 6.3.1 Security vulnerabilities are identified and managed as follows: • New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs). • Vulnerabilities

SOC 2 · 5 controls

  • SOC2-CC7.1 Detection and monitoring procedures for security events are in place
  • SOC2-CC7.3 Evaluates security events to determine incident status
  • SOC2-CC7.4 Responds to identified security incidents through defined procedures
  • SOC2-CC7.5 Identifies the root cause of security incidents
  • SOC2-P6.3 Creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy. The following point of focus, which

NIST SP 800-171 Rev 3 · 4 controls

APRA CPS 234 · 3 controls

  • CPS234-30 Detection and Response Mechanisms
  • CPS234-P24 Information Security Response Plans
  • CPS234-P25 Response Plan Content and Escalation Mechanisms

FedRAMP High · 3 controls

  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-8 Incident Response Plan

FedRAMP Moderate · 3 controls

  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-8 Incident Response Plan

NIST SP 800-53 Rev 5 LOW · 3 controls

  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-8 Incident Response Plan

NIST SP 800-53 Rev 5 MODERATE · 3 controls

  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-8 Incident Response Plan

NIST SP 800-53 Revision 5.1 HIGH · 3 controls

  • IR-2 Incident Response Training
  • IR-4 Incident Handling
  • IR-8 Incident Response Plan

AWS Well-Architected Security Pillar · 2 controls

  • SEC10-BP02 Develop incident management plans
  • SEC10-BP04 Develop and test security incident response playbooks

Azure Security Benchmark · 2 controls

  • ASBv3-GS-7 Define and implement logging, threat detection and incident response strategy
  • ASBv3-IR-1 Preparation - update incident response plan and handling process

C5 (Germany) · 2 controls

  • C5-SIM-01 Policy for security incident management
  • C5-SIM-04 Duty of the users to report security incidents to a central body

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

ISO 27001:2022 · 2 controls

  • 5.24 Information security incident management planning and preparation
  • 5.26 Response to information security incidents

ISO 27002:2022 · 2 controls

  • 5.24 Information security incident management planning and preparation
  • 5.26 Response to information security incidents

ISO 27701:2019 · 2 controls

  • 6.13.1 Management of information security incidents and improvements
  • 6.9 Operations security

NIST SP 800-161 Rev 1 · 2 controls

NIST SP 800-172 · 2 controls

  • 3.6.1e Establish Security Operations Center (SOC)
  • 3.6.2e Establish and Maintain a Cyber Incident Response Team

ACSC Essential Eight · 1 control

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-40 Define a Security Incident Management Procedure

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-27 Identification and Escalation of Incidents and Near Misses

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-28 Continuous incident detection and response (Excellent)

Australia Consumer Data Right - Banking (CDR) · 1 control

Australia My Health Records Act 2012 · 1 control

CMMC 2.0 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Administrative

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.308(a)(6)(i) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gapsIf you hold ISO 27002:202279.1% covered · 14 gapsIf you hold FedRAMP Moderate77.6% covered · 15 gapsIf you hold NIST SP 800-53 Rev 577.6% covered · 15 gapsIf you hold C5 (Germany)76.1% covered · 16 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 82 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll HIPAA Security Rule controls