Frameworks / NIST SP 800-66 Rev 2 / 164.310(d)(2)(iii) NIST SP 800-66 Rev 2
Physical
NIST SP 800-66 Rev 2 164.310(d)(2)(iii): Accountability (Addressable) Maintain a record of the movements of hardware and electronic media containing ePHI and any person responsible. NIST recommends asset tagging, custody logs, and reconciliation.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 45 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
5.11 Return of assets 5.9 Inventory of information and other associated assets 7.10 Storage media 7.9 Security of assets off-premises 8.15 Logging SOC2-CC6.4 CC6.4 Restricting physical access to facilities and assets SOC2-CC6.5 CC6.5 Protecting data on assets until disposal SOC2-CC6.7 CC6.7 Restricting and protecting information in transmission, movement and removal SOC2-P6.2 P6.2 Record of authorised disclosures SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches CIS-1.1 Establish and Maintain Detailed Enterprise Asset Inventory CIS-3.9 Encrypt Data on Removable Media CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS-8.2 Collect Audit Logs 12.5.1 12.5.1 Inventory of in-scope system components 9.4.3 9.4.3 Securing media sent outside the facility 9.4.5 9.4.5 Inventory logs of electronic media 9.4.5.1 9.4.5.1 Annual inventories of electronic media CM-8 System Component Inventory MP-5 Media Transport CM-8 System Component Inventory MP-5 Media Transport 5.9 Inventory of information and other associated assets 7.10 Storage media 5.6 Accountability 7.2.7 Accountability NIST-CSF-ID.AM-01 Inventories of hardware managed by the organization are maintained NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk ASD37-13 Control removable storage media (Very Good) AUCDR-IS-3 Securely manage information assets over their lifecycle Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Physical Query this from an agent The graph holds this control, the 45 it maps to, and the evidence behind each claim, over MCP and REST.