compliance.tf
Azure Compliance FrameworksSpecialized Frameworks

HIPAA HITRUST v9.2

HITRUST is an organization governed by representatives from the healthcare industry. HITRUST created and maintains the Common Security Framework (CSF), a certifiable framework to help healthcare organizations and their providers demonstrate their security and compliance in a consistent and streamlined manner. The CSF builds on HIPAA and the HITECH Act, and incorporates healthcare-specific security, privacy, and other regulatory requirements from existing frameworks such as the PCI DSS, ISO/IEC 27001, and MARS-E.

Controls by Category

0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code (3 controls)

Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for AzureWindows Server virtual machines should have the default Microsoft IaaSAntimalware extension installedVirtual machines should have system updates installed

0301.09o1Organizational.123-09.o 09.07 Media Handling (1 control)

SQL databases should have transparent data encryption enabled

0304.09o3Organizational.1-09.o 09.07 Media Handling (3 controls)

Data Lake Store accounts should have encryption enabledSQL managed instances should use customer-managed keys to encrypt data at restSQL servers should use customer-managed keys to encrypt data at rest

0662.09sCSPOrganizational.2-09.s 09.08 Exchange of Information (1 control)

App Service apps should have 'Client Certificates (Incoming client certificates)' enabled

0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management (4 controls)

Virtual machines should have a vulnerability assessment solution enabledSQL managed instances should have vulnerability assessment enabledSQL databases should have vulnerability findings resolvedSQL servers should have vulnerability assessment enabled

0710.10m2Organizational.1-10.m 10.06 Technical Vulnerability Management (1 control)

SQL managed instances should have vulnerability assessment enabled

0711.10m2Organizational.23-10.m 10.06 Technical Vulnerability Management (1 control)

Virtual machines should have a vulnerability assessment solution enabled

0716.10m3Organizational.1-10.m 10.06 Technical Vulnerability Management (1 control)

SQL databases should have vulnerability findings resolved

0719.10m3Organizational.5-10.m 10.06 Technical Vulnerability Management (1 control)

SQL managed instances should have vulnerability assessment enabled

0805.01m1Organizational.12-01.m 01.04 Network Access Control (11 controls)

App Service apps should use a virtual network service endpointVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionContainer registries should use a virtual network service endpointCosmos DB accounts should use a virtual network service endpointEvent Hub namespaces should use a virtual network service endpointKey vaults should use a virtual network service endpointGateway subnets should not have a network security group configuredSubnets should have a network security group configuredSQL servers should use a virtual network service endpointStorage accounts should use a virtual network service endpoint

0806.01m2Organizational.12356-01.m 01.04 Network Access Control (11 controls)

App Service apps should use a virtual network service endpointVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionContainer registries should use a virtual network service endpointCosmos DB accounts should use a virtual network service endpointEvent Hub namespaces should use a virtual network service endpointKey vaults should use a virtual network service endpointGateway subnets should not have a network security group configuredSubnets should have a network security group configuredSQL servers should use a virtual network service endpointStorage accounts should use a virtual network service endpoint

0809.01n2Organizational.1234-01.n 01.04 Network Access Control (11 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionMySQL servers should have 'Enforce SSL connection' enabledSubnets should have a network security group configuredPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled

0810.01n2Organizational.5-01.n 01.04 Network Access Control (11 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionMySQL servers should have 'Enforce SSL connection' enabledSubnets should have a network security group configuredPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled

0811.01n2Organizational.6-01.n 01.04 Network Access Control (11 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionMySQL servers should have 'Enforce SSL connection' enabledSubnets should have a network security group configuredPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled

0812.01n2Organizational.8-01.n 01.04 Network Access Control (11 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionMySQL servers should have 'Enforce SSL connection' enabledSubnets should have a network security group configuredPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled

0814.01n1Organizational.12-01.n 01.04 Network Access Control (11 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all accessVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionMySQL servers should have 'Enforce SSL connection' enabledSubnets should have a network security group configuredPostgreSQL servers should have 'Enforce SSL connection' enabledAzure Cache for Redis should allow only secure connectionsStorage accounts should have secure transfer enabled

0835.09n1Organizational.1-09.n 09.06 Network Security Management (2 controls)

Windows virtual machines should have the network traffic data collection agent installedVirtual machines should use Azure Resource Manager resources

0836.09.n2Organizational.1-09.n 09.06 Network Security Management (1 control)

Linux virtual machines should have the network traffic data collection agent installed

0837.09.n2Organizational.2-09.n 09.06 Network Security Management (1 control)

Azure subscriptions should have Network Watcher enabled

0858.09m1Organizational.4-09.m 09.06 Network Security Management (2 controls)

Virtual machines should use just-in-time network access control for management portsVirtual machines should have all network ports restricted by their associated network security groups

0860.09m1Organizational.9-09.m 09.06 Network Security Management (1 control)

Network security groups should have Diagnostic Settings configured

0861.09m2Organizational.67-09.m 09.06 Network Security Management (1 control)

App Service apps should use a virtual network service endpoint

0862.09m2Organizational.8-09.m 09.06 Network Security Management (1 control)

SQL servers should use a virtual network service endpoint

0863.09m2Organizational.910-09.m 09.06 Network Security Management (1 control)

Event Hub namespaces should use a virtual network service endpoint

0864.09m2Organizational.12-09.m 09.06 Network Security Management (1 control)

Cosmos DB accounts should use a virtual network service endpoint

0865.09m2Organizational.13-09.m 09.06 Network Security Management (1 control)

Key vaults should use a virtual network service endpoint

0866.09m3Organizational.1516-09.m 09.06 Network Security Management (1 control)

Storage accounts should have network access restrictions configured

0868.09m3Organizational.18-09.m 09.06 Network Security Management (1 control)

Container registries should use a virtual network service endpoint

0869.09m3Organizational.19-09.m 09.06 Network Security Management (1 control)

Container registries should use a virtual network service endpoint

0870.09m3Organizational.20-09.m 09.06 Network Security Management (1 control)

Container registries should use a virtual network service endpoint

0871.09m3Organizational.22-09.m 09.07 Network Security Management (1 control)

Container registries should use a virtual network service endpoint

0885.09n2Organizational.3-09.n 09.06 Network Security Management (1 control)

Linux virtual machines should have the network traffic data collection agent installed

0886.09n2Organizational.4-09.n 09.06 Network Security Management (1 control)

Azure subscriptions should have Network Watcher enabled

0887.09n2Organizational.5-09.n 09.06 Network Security Management (1 control)

Windows virtual machines should have the network traffic data collection agent installed

0888.09n2Organizational.6-09.n 09.06 Network Security Management (1 control)

Azure subscriptions should have Network Watcher enabled

0894.01m2Organizational.7-01.m 01.04 Network Access Control (12 controls)

App Service apps should use a virtual network service endpointVirtual machines should be in an approved virtual networkInternet-facing virtual machines should use network security groups for protectionContainer registries should use a virtual network service endpointCosmos DB accounts should use a virtual network service endpointEvent Hub namespaces should use a virtual network service endpointKey vaults should use a virtual network service endpointGateway subnets should not have a network security group configuredSubnets should have a network security group configuredRegions with newly created virtual networks should have Network Watcher deployedSQL servers should use a virtual network service endpointStorage accounts should use a virtual network service endpoint

0901.09s1Organizational.1-09.s 09.08 Exchange of Information (1 control)

App Service apps should not allow CORS access from every resource

0902.09s2Organizational.13-09.s 09.08 Exchange of Information (1 control)

Function apps should not allow CORS access from every resource

0912.09s1Organizational.4-09.s 09.08 Exchange of Information (1 control)

App Service apps should have remote debugging disabled

0913.09s1Organizational.5-09.s 09.08 Exchange of Information (1 control)

Function apps should have remote debugging disabled

0915.09s2Organizational.2-09.s 09.08 Exchange of Information (1 control)

App Service apps should have Client Certificates (Incoming client certificates) enabled

0916.09s2Organizational.4-09.s 09.08 Exchange of Information (1 control)

App Service apps should not allow CORS access from every resource

0943.09y1Organizational.1-09.y 09.09 Electronic Commerce Services (1 control)

Storage accounts should have secure transfer enabled

0947.09y2Organizational.2-09.y 09.09 Electronic Commerce Services (1 control)

PostgreSQL servers should have 'Enforce SSL connection' enabled

0948.09y2Organizational.3-09.y 09.09 Electronic Commerce Services (1 control)

MySQL servers should have 'Enforce SSL connection' enabled

0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services (4 controls)

App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessFunction apps should use the latest TLS versionFunction apps should require HTTPS for all access

0960.09sCSPOrganizational.1-09.s 09.08 Exchange of Information (1 control)

Function apps should not allow CORS access from every resource

11112.01q2Organizational.67-01.q 01.05 Operating System Access Control (1 control)

Azure subscriptions should limit owners to 3

11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems (1 control)

Virtual machines should use just-in-time network access control for management ports

1119.01j2Organizational.3-01.j 01.04 Network Access Control (1 control)

Virtual machines should use just-in-time network access control for management ports

1120.09ab3System.9-09.ab 09.10 Monitoring (1 control)

Azure Monitor should have activity log collection enabled for all regions

1143.01c1System.123-01.c 01.02 Authorized Access to Information Systems (1 control)

Virtual machines should have management ports closed

1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should limit owners to 3

1145.01c2System.1-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should have more than one owner

1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should not have guest accounts with owner permissions

1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should not have blocked accounts with owner permissions

1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems (1 control)

Custom RBAC roles should not be used

1150.01c2System.10-01.c 01.02 Authorized Access to Information Systems (1 control)

Virtual machines should have management ports closed

1151.01c3System.1-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should limit owners to 3

1152.01c3System.2-01.c 01.02 Authorized Access to Information Systems (1 control)

Azure subscriptions should have more than one owner

1153.01c3System.35-01.c 01.02 Authorized Access to Information Systems (1 control)

Kubernetes clusters should use Role-Based Access Control (RBAC)

1175.01j1Organizational.8-01.j 01.04 Network Access Control (1 control)

Virtual machines should use just-in-time network access control for management ports

1179.01j3Organizational.1-01.j 01.04 Network Access Control (1 control)

Virtual machines should use just-in-time network access control for management ports

1192.01l1Organizational.1-01.l 01.04 Network Access Control (1 control)

Virtual machines should use just-in-time network access control for management ports

1193.01l2Organizational.13-01.l 01.04 Network Access Control (1 control)

Virtual machines should have management ports closed

1194.01l2Organizational.2-01.l 01.04 Network Access Control (1 control)

App Service apps should have remote debugging disabled

1195.01l3Organizational.1-01.l 01.04 Network Access Control (1 control)

Function apps should have remote debugging disabled

1202.09aa1System.1-09.aa 09.10 Monitoring (1 control)

Data Lake Store accounts should have resource logs enabled

1203.09aa1System.2-09.aa 09.10 Monitoring (1 control)

Logic App workflows should have resource logs enabled

1204.09aa1System.3-09.aa 09.10 Monitoring (1 control)

IoT hubs should have resource logs enabled

1205.09aa2System.1-09.aa 09.10 Monitoring (1 control)

Batch accounts should have resource logs enabled

1207.09aa2System.4-09.aa 09.10 Monitoring (2 controls)

Event Hub namespaces should have resource logs enabledStream Analytics jobs should have resource logs enabled

1208.09aa3System.1-09.aa 09.10 Monitoring (2 controls)

Search services should have resource logs enabledService Bus namespaces should have resource logs enabled

1209.09aa3System.2-09.aa 09.10 Monitoring (1 control)

App Service apps should have resource logs enabled

1210.09aa3System.3-09.aa 09.10 Monitoring (1 control)

Data Lake Analytics accounts should have resource logs enabled

12100.09ab2System.15-09.ab 09.10 Monitoring (1 control)

Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring

12101.09ab1Organizational.3-09.ab 09.10 Monitoring (1 control)

Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring

12102.09ab1Organizational.4-09.ab 09.10 Monitoring (1 control)

Windows machines should have the Log Analytics agent connected as expected

1211.09aa3System.4-09.aa 09.10 Monitoring (3 controls)

Key vaults should have resource logs enabledKey Vault Managed HSMs should have resource logs enabledSQL servers should have auditing enabled

1212.09ab1System.1-09.ab 09.10 Monitoring (1 control)

Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories

1213.09ab2System.128-09.ab 09.10 Monitoring (1 control)

Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

1214.09ab2System.3456-09.ab 09.10 Monitoring (1 control)

Azure Monitor should have activity log collection enabled for all regions

1215.09ab2System.7-09.ab 09.10 Monitoring (1 control)

Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring

1216.09ab3System.12-09.ab 09.10 Monitoring (1 control)

Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring

1217.09ab3System.3-09.ab 09.10 Monitoring (1 control)

Windows machines should have the Log Analytics agent connected as expected

1219.09ab3System.10-09.ab 09.10 Monitoring (1 control)

Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories

1220.09ab3System.56-09.ab 09.10 Monitoring (1 control)

Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

1229.09c1Organizational.1-09.c 09.01 Documented Operating Procedures (1 control)

Kubernetes clusters should use Role-Based Access Control (RBAC)

1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures (1 control)

Custom RBAC roles should not be used

1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures (1 control)

Network security groups should have RDP access restrictions configured

1270.09ad1System.12-09.ad 09.10 Monitoring (1 control)

Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations

1271.09ad1System.1-09.ad 09.10 Monitoring (1 control)

Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations

1325.09s1Organizational.3-09.s 09.08 Exchange of Information (1 control)

Function apps should have remote debugging disabled

1450.05i2Organizational.2-05.i 05.02 External Parties (1 control)

PostgreSQL servers should have 'Enforce SSL connection' enabled

1451.05iCSPOrganizational.2-05.i 05.02 External Parties (1 control)

Azure Cache for Redis should allow only secure connections

1616.09l1Organizational.16-09.l 09.05 Information Back-Up (1 control)

Azure SQL databases should have long-term geo-redundant backup enabled

1617.09l1Organizational.23-09.l 09.05 Information Back-Up (1 control)

MySQL servers should have geo-redundant backup enabled

1618.09l1Organizational.45-09.l 09.05 Information Back-Up (1 control)

PostgreSQL servers should have geo-redundant backup enabled

1619.09l1Organizational.7-09.l 09.05 Information Back-Up (1 control)

MariaDB servers should have geo-redundant backup enabled

1621.09l2Organizational.1-09.l 09.05 Information Back-Up (1 control)

Azure SQL databases should have long-term geo-redundant backup enabled

1622.09l2Organizational.23-09.l 09.05 Information Back-Up (1 control)

MySQL servers should have geo-redundant backup enabled

1623.09l2Organizational.4-09.l 09.05 Information Back-Up (1 control)

PostgreSQL servers should have geo-redundant backup enabled

1624.09l3Organizational.12-09.l 09.05 Information Back-Up (1 control)

MariaDB servers should have geo-redundant backup enabled

1626.09l3Organizational.5-09.l 09.05 Information Back-Up (1 control)

PostgreSQL servers should have geo-redundant backup enabled

1627.09l3Organizational.6-09.l 09.05 Information Back-Up (1 control)

MariaDB servers should have geo-redundant backup enabled

1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management (1 control)

Virtual machines should have disaster recovery configured

1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management (2 controls)

Key Vault Managed HSMs should have purge protection enabledKey vaults should have deletion protection enabled

1638.12b2Organizational.345-12.b 12.01 Information Security Aspects of Business Continuity Management (1 control)

Virtual machines should have disaster recovery configured

Other (6 controls)

Function apps should use managed identityApp Service web apps should require HTTPS for all accessApp Service apps should use managed identityAzure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissions

Related Frameworks

NIST SP 800-53 Rev 5 — 🟢 High overlap (72%)

FedRAMP High — 🟢 High overlap (71%)

NIST SP 800-171 Rev 2 — 🟢 High overlap (69%)

FedRAMP High

Previous Page

HIPAA Security Rule 2003

Next Page

On this page

Controls by Category0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code (3)0301.09o1Organizational.123-09.o 09.07 Media Handling (1)0304.09o3Organizational.1-09.o 09.07 Media Handling (3)0662.09sCSPOrganizational.2-09.s 09.08 Exchange of Information (1)0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management (4)0710.10m2Organizational.1-10.m 10.06 Technical Vulnerability Management (1)0711.10m2Organizational.23-10.m 10.06 Technical Vulnerability Management (1)0716.10m3Organizational.1-10.m 10.06 Technical Vulnerability Management (1)0719.10m3Organizational.5-10.m 10.06 Technical Vulnerability Management (1)0805.01m1Organizational.12-01.m 01.04 Network Access Control (11)0806.01m2Organizational.12356-01.m 01.04 Network Access Control (11)0809.01n2Organizational.1234-01.n 01.04 Network Access Control (11)0810.01n2Organizational.5-01.n 01.04 Network Access Control (11)0811.01n2Organizational.6-01.n 01.04 Network Access Control (11)0812.01n2Organizational.8-01.n 01.04 Network Access Control (11)0814.01n1Organizational.12-01.n 01.04 Network Access Control (11)0835.09n1Organizational.1-09.n 09.06 Network Security Management (2)0836.09.n2Organizational.1-09.n 09.06 Network Security Management (1)0837.09.n2Organizational.2-09.n 09.06 Network Security Management (1)0858.09m1Organizational.4-09.m 09.06 Network Security Management (2)0860.09m1Organizational.9-09.m 09.06 Network Security Management (1)0861.09m2Organizational.67-09.m 09.06 Network Security Management (1)0862.09m2Organizational.8-09.m 09.06 Network Security Management (1)0863.09m2Organizational.910-09.m 09.06 Network Security Management (1)0864.09m2Organizational.12-09.m 09.06 Network Security Management (1)0865.09m2Organizational.13-09.m 09.06 Network Security Management (1)0866.09m3Organizational.1516-09.m 09.06 Network Security Management (1)0868.09m3Organizational.18-09.m 09.06 Network Security Management (1)0869.09m3Organizational.19-09.m 09.06 Network Security Management (1)0870.09m3Organizational.20-09.m 09.06 Network Security Management (1)0871.09m3Organizational.22-09.m 09.07 Network Security Management (1)0885.09n2Organizational.3-09.n 09.06 Network Security Management (1)0886.09n2Organizational.4-09.n 09.06 Network Security Management (1)0887.09n2Organizational.5-09.n 09.06 Network Security Management (1)0888.09n2Organizational.6-09.n 09.06 Network Security Management (1)0894.01m2Organizational.7-01.m 01.04 Network Access Control (12)0901.09s1Organizational.1-09.s 09.08 Exchange of Information (1)0902.09s2Organizational.13-09.s 09.08 Exchange of Information (1)0912.09s1Organizational.4-09.s 09.08 Exchange of Information (1)0913.09s1Organizational.5-09.s 09.08 Exchange of Information (1)0915.09s2Organizational.2-09.s 09.08 Exchange of Information (1)0916.09s2Organizational.4-09.s 09.08 Exchange of Information (1)0943.09y1Organizational.1-09.y 09.09 Electronic Commerce Services (1)0947.09y2Organizational.2-09.y 09.09 Electronic Commerce Services (1)0948.09y2Organizational.3-09.y 09.09 Electronic Commerce Services (1)0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services (4)0960.09sCSPOrganizational.1-09.s 09.08 Exchange of Information (1)11112.01q2Organizational.67-01.q 01.05 Operating System Access Control (1)11180.01c3System.6-01.c 01.02 Authorized Access to Information Systems (1)1119.01j2Organizational.3-01.j 01.04 Network Access Control (1)1120.09ab3System.9-09.ab 09.10 Monitoring (1)1143.01c1System.123-01.c 01.02 Authorized Access to Information Systems (1)1144.01c1System.4-01.c 01.02 Authorized Access to Information Systems (1)1145.01c2System.1-01.c 01.02 Authorized Access to Information Systems (1)1146.01c2System.23-01.c 01.02 Authorized Access to Information Systems (1)1147.01c2System.456-01.c 01.02 Authorized Access to Information Systems (1)1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems (1)1150.01c2System.10-01.c 01.02 Authorized Access to Information Systems (1)1151.01c3System.1-01.c 01.02 Authorized Access to Information Systems (1)1152.01c3System.2-01.c 01.02 Authorized Access to Information Systems (1)1153.01c3System.35-01.c 01.02 Authorized Access to Information Systems (1)1175.01j1Organizational.8-01.j 01.04 Network Access Control (1)1179.01j3Organizational.1-01.j 01.04 Network Access Control (1)1192.01l1Organizational.1-01.l 01.04 Network Access Control (1)1193.01l2Organizational.13-01.l 01.04 Network Access Control (1)1194.01l2Organizational.2-01.l 01.04 Network Access Control (1)1195.01l3Organizational.1-01.l 01.04 Network Access Control (1)1202.09aa1System.1-09.aa 09.10 Monitoring (1)1203.09aa1System.2-09.aa 09.10 Monitoring (1)1204.09aa1System.3-09.aa 09.10 Monitoring (1)1205.09aa2System.1-09.aa 09.10 Monitoring (1)1207.09aa2System.4-09.aa 09.10 Monitoring (2)1208.09aa3System.1-09.aa 09.10 Monitoring (2)1209.09aa3System.2-09.aa 09.10 Monitoring (1)1210.09aa3System.3-09.aa 09.10 Monitoring (1)12100.09ab2System.15-09.ab 09.10 Monitoring (1)12101.09ab1Organizational.3-09.ab 09.10 Monitoring (1)12102.09ab1Organizational.4-09.ab 09.10 Monitoring (1)1211.09aa3System.4-09.aa 09.10 Monitoring (3)1212.09ab1System.1-09.ab 09.10 Monitoring (1)1213.09ab2System.128-09.ab 09.10 Monitoring (1)1214.09ab2System.3456-09.ab 09.10 Monitoring (1)1215.09ab2System.7-09.ab 09.10 Monitoring (1)1216.09ab3System.12-09.ab 09.10 Monitoring (1)1217.09ab3System.3-09.ab 09.10 Monitoring (1)1219.09ab3System.10-09.ab 09.10 Monitoring (1)1220.09ab3System.56-09.ab 09.10 Monitoring (1)1229.09c1Organizational.1-09.c 09.01 Documented Operating Procedures (1)1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures (1)1232.09c3Organizational.12-09.c 09.01 Documented Operating Procedures (1)1270.09ad1System.12-09.ad 09.10 Monitoring (1)1271.09ad1System.1-09.ad 09.10 Monitoring (1)1325.09s1Organizational.3-09.s 09.08 Exchange of Information (1)1450.05i2Organizational.2-05.i 05.02 External Parties (1)1451.05iCSPOrganizational.2-05.i 05.02 External Parties (1)1616.09l1Organizational.16-09.l 09.05 Information Back-Up (1)1617.09l1Organizational.23-09.l 09.05 Information Back-Up (1)1618.09l1Organizational.45-09.l 09.05 Information Back-Up (1)1619.09l1Organizational.7-09.l 09.05 Information Back-Up (1)1621.09l2Organizational.1-09.l 09.05 Information Back-Up (1)1622.09l2Organizational.23-09.l 09.05 Information Back-Up (1)1623.09l2Organizational.4-09.l 09.05 Information Back-Up (1)1624.09l3Organizational.12-09.l 09.05 Information Back-Up (1)1626.09l3Organizational.5-09.l 09.05 Information Back-Up (1)1627.09l3Organizational.6-09.l 09.05 Information Back-Up (1)1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management (1)1635.12b1Organizational.2-12.b 12.01 Information Security Aspects of Business Continuity Management (2)1638.12b2Organizational.345-12.b 12.01 Information Security Aspects of Business Continuity Management (1)Other (6)Related Frameworks

Ask AI about this

Help improve this page