HIPAA Security Rule 164.316(b)(1): Documentation (Standard)

What else in your programme already covers this

This control maps to 77 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 17 controls

1.2.3 1.2.3 Accurate network diagram of CDE connections
1.2.5 1.2.5 Allowed services, protocols and ports justified
11.4.1 11.4.1 Penetration testing methodology defined and implemented
12.1.1 12.1.1 Overall information security policy established and disseminated
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
12.3.3 12.3.3 Cryptographic cipher suite and protocol inventory reviewed annually
12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
12.8.4 12.8.4 Annual monitoring of TPSP compliance status
2.1.1 2.1.1 Requirement 2 policies and procedures governed
2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned
4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned
5.3.4 5.3.4 Anti-malware audit logs enabled and retained
6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned
3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use
6.3.2 6.3.2 Inventory of bespoke software and components
8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned

NIST SP 800-53 Rev 5 · 8 controls

NIST800-AT-4 AT-4 Training Records
NIST800-AU-11 AU-11 Audit Record Retention
NIST800-CA-5 CA-5 Plan of Action and Milestones
NIST800-PL-1 PL-1 Policy and Procedures
NIST800-PL-2 PL-2 System Security and Privacy Plans
NIST800-PM-21 PM-21 Accounting of Disclosures
NIST800-PM-28 PM-28 Risk Framing
NIST800-SA-5 SA-5 System Documentation

NIST Cybersecurity Framework 2.0 · 6 controls

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring
NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

SOC 2 · 5 controls

SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
SOC2-CC6.5 CC6.5 Protecting data on assets until disposal
SOC2-P6.2 P6.2 Record of authorised disclosures
SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches

CIS Controls v8 · 4 controls

CIS-2.1 Establish and Maintain a Software Inventory
CIS-6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems
CIS-8.1 Establish and Maintain an Audit Log Management Process
CIS-8.10 Retain Audit Logs

ISO 27701:2019 · 4 controls

5.5.5 Documented information
6.3 Organization of information security
6.9.1 Operational procedures and responsibilities
8.2 Conditions for collection and processing

FedRAMP High · 3 controls

AT-4 Training Records
PL-2 System Security and Privacy Plans
SI-12 Information Management and Retention

FedRAMP Moderate · 3 controls

AT-4 Training Records
PL-2 System Security and Privacy Plans
SI-12 Information Management and Retention

ISO 22301:2019 · 3 controls

7.5 Documented information
7.5.1 General
7.5.3 Control of documented information

ISO 27001:2022 · 3 controls

5.1 Policies for information security
5.33 Protection of records
5.37 Documented operating procedures

ISO 27002:2022 · 3 controls

5.1 Policies for information security
5.33 Protection of records
5.37 Documented operating procedures

NIST SP 800-161 Rev 1 · 3 controls

161R1-AT-4 Training Records
161R1-PL-2 System Security and Privacy Plans
161R1-SA-5 System Documentation

NIST SP 800-171 Rev 3 · 3 controls

03.03.03 Audit Record Generation
03.15.01 Policy and Procedures
03.15.02 System Security Plan

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-BCR-05 Documentation
CCM-GRC-01 Governance Program Policy and Procedures

ISO/IEC 42001:2023 · 2 controls

7.5 Documented information
7.5.3 Control of documented information

APRA CPS 234 · 1 control

CPS234-19 Information Security Policy Framework

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data

Australia My Health Records Act 2012 · 1 control

MYHR-SBD-3 Record keeping for sharing with the My Health Record system

C5 (Germany) · 1 control

C5-SP-01 Documentation, communication and provision of policies and instructions

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-20 Production of System Safeguards Books and Records

CMMC 2.0 · 1 control

CA.L2-3.12.4 System Security Plan

NIST SP 800-172 · 1 control

3.11.4e Security Solution Rationale Document

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.316(b)(1) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gaps If you hold ISO 27002:202279.1% covered · 14 gaps If you hold FedRAMP Moderate77.6% covered · 15 gaps If you hold NIST SP 800-53 Rev 577.6% covered · 15 gaps If you hold C5 (Germany)76.1% covered · 16 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free