NIST Cybersecurity Framework
Comprehensive guide to NIST cybersecurity frameworks and guidelines with implementation guidance and HIPAA mapping for healthcare organizations.
Coverage Overview
Track published NIST guideline coverage by category and framework.
All Guidelines
1,072 guidelines found
Access Control Policy and Procedures
AC-1 requires developing, documenting, disseminating, reviewing, and updating an access control policy and procedures that address purpose, scope… ...
Access Control Policy Enhancement
AC-1(1) enhances AC-1 by focusing on access control policy enhancement. Disseminate and acknowledge an access control policy covering workforce, BA… ...
Access Control Procedures Enhancement
AC-1(2) enhances AC-1 by focusing on access control procedures enhancement. Operationalize procedures for account requests, approvals, reviews, and… ...
Concurrent Session Control
AC-10 limits the number of concurrent sessions for each system account. By capping how many simultaneous logons a user (or role) may hold… ...
Concurrent Session Control by Account Type
AC-10(1) enhances AC-10 by focusing on concurrent session control by account type. Limit concurrent sessions by account type (stricter for… ...
Session Lock
AC-11 requires initiating a session lock after an organization-defined period of inactivity, or on user demand, and retaining the lock until the user… ...
Pattern-Hiding Displays
AC-11(1) enhances base AC-11 session lock by requiring the system to conceal, via the device display, information previously visible on the display… ...
Session Termination
AC-12 requires automatic termination of user sessions after organization-defined conditions are met — typically periods of inactivity, end of a work… ...
User-Initiated Logouts
AC-12(1) enhances base AC-12 session termination by providing a logout capability for user-initiated communications sessions whenever authentication… ...
AC-13 Withdrawn / Not Selected in Current Baseline
AC-13 is not an active NIST SP 800-53 Revision 5 base control. The identifier appears in some legacy catalogs or as an unused numbering slot within… ...
Permitted Actions Without Identification or Authentication
AC-14 requires identifying user actions that can be performed on the information system without identification or authentication, and documenting or… ...
Dual Authorization
AC-14(1) enhances AC-14 by focusing on dual authorization. Require dual authorization before permitting specific actions without normal… ...
Understanding NIST Framework
Essential information about the NIST Cybersecurity Framework and how it applies to healthcare.
HIPAA Alignment
NIST frameworks provide detailed technical guidance for implementing HIPAA security requirements effectively.
Best Practices
Industry-recognized best practices and implementation guidance from cybersecurity experts.
Continuous Improvement
Framework-based approach enables ongoing assessment and improvement of your security posture.
Guideline Coverage Strategy
For comprehensive implementation, map your selected guidelines to HIPAA safeguards and cover the full lifecycle of identify, protect, detect, respond, and recover activities.
Governance and Risk
Define roles, maintain risk registers, and align controls with policy and audit evidence requirements.
Protect and Detect
Implement hardening, access security, encryption, logging, and alerting with documented validation procedures.
Respond and Recover
Operationalize incident response, communications, and recovery playbooks with regular tabletop testing.
Need Help with NIST Implementation?
Our certified auditors align NIST guidelines with your HIPAA program so one set of controls satisfies both. Compare these guidelines against the HIPAA Security Rule controls they map to, explore our compliance services, or download free implementation templates.