NIST SP 800-66 Rev 2
NIST SP 800-66 Rev 2 Implementing the HIPAA Security Rule (Feb 2024).
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Administrative
| Code | Title |
|---|---|
| 164.308(a)(1)(i) | Security Management Process (Standard) |
| 164.308(a)(1)(ii)(A) | Risk Analysis (Required) |
| 164.308(a)(1)(ii)(B) | Risk Management (Required) |
| 164.308(a)(1)(ii)(C) | Sanction Policy (Required) |
| 164.308(a)(1)(ii)(D) | Information System Activity Review (Required) |
| 164.308(a)(2) | Assigned Security Responsibility (Standard) |
| 164.308(a)(3)(i) | Workforce Security (Standard) |
| 164.308(a)(3)(ii)(A) | Authorization and Supervision (Addressable) |
| 164.308(a)(3)(ii)(B) | Workforce Clearance Procedure (Addressable) |
| 164.308(a)(3)(ii)(C) | Termination Procedures (Addressable) |
| 164.308(a)(4)(i) | Information Access Management (Standard) |
| 164.308(a)(4)(ii)(A) | Isolating Health Care Clearinghouse Functions (Required if applicable) |
| 164.308(a)(4)(ii)(B) | Access Authorization (Addressable) |
| 164.308(a)(4)(ii)(C) | Access Establishment and Modification (Addressable) |
| 164.308(a)(5)(i) | Security Awareness and Training (Standard) |
| 164.308(a)(5)(ii)(A) | Security Reminders (Addressable) |
| 164.308(a)(5)(ii)(B) | Protection from Malicious Software (Addressable) |
| 164.308(a)(5)(ii)(C) | Log-in Monitoring (Addressable) |
| 164.308(a)(5)(ii)(D) | Password Management (Addressable) |
| 164.308(a)(6)(i) | Security Incident Procedures (Standard) |
| 164.308(a)(6)(ii) | Response and Reporting (Required) |
| 164.308(a)(7)(i) | Contingency Plan (Standard) |
| 164.308(a)(7)(ii)(A) | Data Backup Plan (Required) |
| 164.308(a)(7)(ii)(B) | Disaster Recovery Plan (Required) |
| 164.308(a)(7)(ii)(C) | Emergency Mode Operation Plan (Required) |
| 164.308(a)(7)(ii)(D) | Testing and Revision Procedures (Addressable) |
| 164.308(a)(7)(ii)(E) | Applications and Data Criticality Analysis (Addressable) |
| 164.308(a)(8) | Evaluation (Standard) |
| RA-EPHI-LOC | Risk Analysis: Identify Where ePHI Is Created, Received, Maintained, or Transmitted |
| RA-IMPACT | Risk Analysis: Determine the Impact of a Threat Exploiting a Vulnerability |
| RA-LIKELIHOOD | Risk Analysis: Determine the Likelihood of a Threat Exploiting a Vulnerability |
| RA-PREP | Risk Analysis: Prepare for the Assessment |
| RA-RISK | Risk Analysis: Determine the Level of Risk |
| RA-SCOPE | Risk Analysis: Identify Scope of the Analysis |
| RA-THREATS | Risk Analysis: Identify Threats to ePHI |
| RA-VULN | Risk Analysis: Identify Potential Vulnerabilities and Predisposing Conditions |
Documentation
| Code | Title |
|---|---|
| 164.316(a) | Policies and Procedures (Standard) |
| 164.316(b)(1) | Documentation (Standard) |
| 164.316(b)(2) | Time Limit, Availability, and Updates (Required) |
| RA-DOC | Risk Analysis: Document the Risk Assessment Results |
Organizational
| Code | Title |
|---|---|
| 164.308(b)(1) | Business Associate Contracts and Other Arrangements (Standard) |
Physical
| Code | Title |
|---|---|
| 164.310(a)(1) | Facility Access Controls (Standard) |
| 164.310(a)(2)(i) | Contingency Operations (Addressable) |
| 164.310(a)(2)(ii) | Facility Security Plan (Addressable) |
| 164.310(a)(2)(iii) | Access Control and Validation Procedures (Addressable) |
| 164.310(a)(2)(iv) | Maintenance Records (Addressable) |
| 164.310(b) | Workstation Use (Standard) |
| 164.310(c) | Workstation Security (Standard) |
| 164.310(d)(1) | Device and Media Controls (Standard) |
| 164.310(d)(2)(i) | Disposal (Required) |
| 164.310(d)(2)(ii) | Media Re-use (Required) |
| 164.310(d)(2)(iii) | Accountability (Addressable) |
| 164.310(d)(2)(iv) | Data Backup and Storage (Addressable) |
Technical
| Code | Title |
|---|---|
| 164.312(a)(1) | Access Control (Standard) |
| 164.312(a)(2)(i) | Unique User Identification (Required) |
| 164.312(a)(2)(ii) | Emergency Access Procedure (Required) |
| 164.312(a)(2)(iii) | Automatic Logoff (Addressable) |
| 164.312(a)(2)(iv) | Encryption and Decryption (Addressable) |
| 164.312(b) | Audit Controls (Standard) |
| 164.312(c)(1) | Integrity (Standard) |
| 164.312(c)(2) | Mechanism to Authenticate ePHI (Addressable) |
| 164.312(d) | Person or Entity Authentication (Standard) |
| 164.312(e)(1) | Transmission Security (Standard) |
| 164.312(e)(2)(i) | Integrity Controls for Transmission (Addressable) |
| 164.312(e)(2)(ii) | Encryption of Transmissions (Addressable) |
Your Compliance Coverage
If you comply with NIST SP 800-66 Rev 2, you already cover:
FedRAMP High
85%
55 controls mapped
Compare →FedRAMP Moderate
85%
55 controls mapped
Compare →NIST SP 800-53 Rev 5
85%
55 controls mapped
Compare →+ 20 more: SOC 2 (85%), NIST SP 800-53 Revision 5.1 HIGH (83%)
See all 23 mapped frameworks ↓Maps to 23 other frameworks
Frequently Asked Questions
What is NIST SP 800-66 Rev 2?
NIST SP 800-66 Rev 2 is a compliance framework from United States with 5 domains and 65 controls. NIST SP 800-66 Rev 2 Implementing the HIPAA Security Rule (Feb 2024). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does NIST SP 800-66 Rev 2 have?
NIST SP 800-66 Rev 2 has 65 controls organised across 5 domains. The largest domains are Administrative (36 controls), Physical (12 controls), Technical (12 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does NIST SP 800-66 Rev 2 map to?
NIST SP 800-66 Rev 2 maps to 23 other compliance frameworks. The top mapping partners are FedRAMP High (85% coverage), FedRAMP Moderate (85% coverage), NIST SP 800-53 Rev 5 (85% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with NIST SP 800-66 Rev 2 compliance?
Start your NIST SP 800-66 Rev 2 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-66 Rev 2 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 65 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required