HIPAA Security Rule 164.308(b)(3): Written Contract or Other Arrangement

What else in your programme already covers this

This control maps to 41 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
NIST-CSF-GV.SC-04 Suppliers are known and prioritized by criticality
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-ID.AM-04 Inventories of services provided by suppliers are maintained
NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
NIST-CSF-ID.RA-10 Critical suppliers are assessed prior to acquisition

NIST SP 800-53 Rev 5 · 4 controls

NIST800-AC-20 Use of external systems
NIST800-PS-6 Access agreements
NIST800-SA-4 Acquisition process
NIST800-SR-7 Supply Chain Operations Security. Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [organization-defined]

CIS Controls v8 · 3 controls

CIS-15.1 Establish and Maintain an Inventory of Service Providers
CIS-15.2 Establish and Maintain a Service Provider Management Policy
CIS-15.4 Ensure Service Provider Contracts Include Security Requirements

SOC 2 · 3 controls

SOC2-CC9.2 Risk mitigation activities include assessment of vendor and business partner controls
SOC2-P6.4 Obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed
SOC2-P6.5 Obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to

C5 (Germany) · 2 controls

C5-SSO-01 Policies and instructions for controlling and monitoring third parties
C5-SSO-04 Monitoring of compliance with requirements

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-STA-07 Supply Chain Inventory
CCM-STA-09 Primary Service and Contractual Agreement

FedRAMP High · 2 controls

SA-4 Acquisition Process
SR-6 Supplier Assessments and Reviews (SR-6)

FedRAMP Moderate · 2 controls

SA-4 Acquisition Process
SR-6 Supplier Assessments and Reviews (SR-6)

ISO 27001:2022 · 2 controls

5.20 Addressing information security within supplier agreements
6.6 Confidentiality or non-disclosure agreements

NIST SP 800-161 Rev 1 · 2 controls

161R1-SA-4 Acquisition Process
161R1-SR-8 Notification Agreements

NIST SP 800-53 Rev 5 MODERATE · 2 controls

SA-4 Acquisition Process
SR-6 Supplier Assessments and Reviews (SR-6)

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

SA-4 Acquisition Process
SR-6 Supplier Assessments and Reviews (SR-6)

APRA CPS 230 Operational Risk Management · 1 control

CPS230-50 Formal Agreement Content for Material Arrangements

APRA CPS 234 · 1 control

CPS234-P19 Policy Direction to All Responsible Parties

Australia My Health Records Act 2012 · 1 control

MYHR-REG-4 Contracted service provider oversight

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-26 Own Resources or Contractual Arrangements to Meet the Recovery Objective

ISO 27002:2022 · 1 control

5.20 Addressing information security within supplier agreements

NIST SP 800-53 Rev 5 LOW · 1 control

SA-4 Acquisition Process

PCI DSS 4.0 · 1 control

12.8.2 Written agreements with TPSPs

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.308(b)(3) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gaps If you hold ISO 27002:202279.1% covered · 14 gaps If you hold FedRAMP Moderate77.6% covered · 15 gaps If you hold NIST SP 800-53 Rev 577.6% covered · 15 gaps If you hold C5 (Germany)76.1% covered · 16 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free