Skip to content

    ISO/IEC 27001:2022 (ISMS clauses) to HIPAA (Security, Privacy and Breach Notification Rules) control mapping

    ISO/IEC 27001:2022 (ISMS clauses) and HIPAA (Security, Privacy and Breach Notification Rules) both map to 42 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.

    Shared NIST 800-53 controls
    42
    ISO/IEC 27001:2022 (ISMS clauses) controls involved
    21
    HIPAA (Security, Privacy and Breach Notification Rules) controls involved
    73
    NIST 800-53 families touched
    20

    How this pairing is derived

    Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored ISO/IEC 27001:2022 (ISMS clauses) to HIPAA (Security, Privacy and Breach Notification Rules) crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.

    Shared controls in full

    NIST SP 800-53 Rev 5 controls mapped by both ISO/IEC 27001:2022 (ISMS clauses) and HIPAA (Security, Privacy and Breach Notification Rules), with the controls on each side that map to them.
    NIST 800-53 controlFamilyISO/IEC 27001:2022 (ISMS clauses) controlsHIPAA (Security, Privacy and Breach Notification Rules) controls
    AC-1Policy and ProceduresACAccess Control5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(B), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(c)(2)(ii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    AT-1Policy and ProceduresATAwareness and Training5.1, 5.2, 7.4, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(5)(i), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    AT-2Literacy Training and AwarenessATAwareness and Training7.4164.308(a)(5)(i), 164.530(b)(2)(i), 164.530(b)(2)(i)(A), 164.530(b)(2)(i)(B), 164.530(b)(2)(i)(C), 164.530(b)(2)(ii)
    AU-1Policy and ProceduresAUAudit and Accountability5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(1)(ii)(D), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    CA-1Policy and ProceduresCAAssessment, Authorization, and Monitoring5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    CA-2Control AssessmentsCAAssessment, Authorization, and Monitoring8.1, 9.1164.306(d)(3)(i), 164.306(e), 164.308(a)(8), 164.316(b)(1)
    CA-7Continuous MonitoringCAAssessment, Authorization, and Monitoring10.1, 8.1164.306(d)(3)(i), 164.316(b)(2)(iii)
    CA-7(1)Independent AssessmentCAAssessment, Authorization, and Monitoring10.1, 8.1164.306(d)(3)(i), 164.316(b)(2)(iii)
    CM-1Policy and ProceduresCMConfiguration Management5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    CM-3Configuration Change ControlCMConfiguration Management6.3164.308(a)(1)(i)
    CP-1Policy and ProceduresCPContingency Planning5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.308(a)(7)(ii)(C), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    IA-1Policy and ProceduresIAIdentification and Authentication5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(4)(ii)(B), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(c)(2)(ii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    IR-1Policy and ProceduresIRIncident Response5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    MA-1Policy and ProceduresMAMaintenance5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PE-1Policy and ProceduresPEPhysical and Environmental Protection5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PL-1Policy and ProceduresPLPlanning4.1, 5.1, 5.2, 7.5.1, 7.5.2, 7.5.3, 9.1, 9.2.1, 9.2.2164.306(c), 164.306(d)(1), 164.306(d)(2), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.314(a)(1), 164.314(a)(2)(ii), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.504(g)(1), 164.530(i)(1), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PL-4Rules of BehaviorPLPlanning7.3164.310(b)
    PL-9Central ManagementPLPlanning5.1, 5.3164.308(a)(2)
    RA-1Policy and ProceduresRARisk Assessment5.1, 5.2, 6.1.1, 6.1.2, 7.5.1, 7.5.2, 7.5.3, 8.2164.306(a)(3), 164.306(b)(2)(iv), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    RA-2Security CategorizationRARisk Assessment6.1.2164.306(b)(2)(iv)
    RA-3Risk AssessmentRARisk Assessment6.1.2, 8.2164.306(b)(2)(iv), 164.306(d)(3)(i), 164.306(e), 164.308(a)(1)(ii)(A), 164.308(a)(8)
    SA-1Policy and ProceduresSASystem and Services Acquisition5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    SA-8(32)Sufficient DocumentationSASystem and Services Acquisition8.1164.310(b), 164.316(b)(2)(ii)
    SA-9(3)Establish and Maintain Trust Relationship with ProvidersSASystem and Services Acquisition4.3164.308(a)(7)(ii)(E), 164.308(b)(1), 164.504(e)(2)(iii)
    SC-1Policy and ProceduresSCSystem and Communications Protection5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.306(b)(1), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.312(e)(1), 164.312(e)(2)(i), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    SI-1Policy and ProceduresSISystem and Information Integrity5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.306(b)(1), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    MP-1Policy and ProceduresMPMedia Protection5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.306(a)(3), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.514(d)(3)(i), 164.530(c)(2)(i), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PS-1Policy and ProceduresPSPersonnel Security5.1, 5.2, 7.2, 7.3, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.312(d), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(e)(2), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PS-2Position Risk DesignationPSPersonnel Security7.2164.308(a)(3)(ii)(B), 164.312(a)(1), 164.530(a)(2)
    PS-3Personnel ScreeningPSPersonnel Security7.2164.312(d)
    PS-9Position DescriptionsPSPersonnel Security5.3, 7.3164.308(a)(3)(ii)(B), 164.310(a)(2)(i), 164.312(a)(1), 164.530(a)(2)
    PM-1Information Security Program PlanPMProgram Management10.1, 4.4, 5.1, 5.2, 6.1.1, 7.5.1, 7.5.2, 7.5.3, 8.1164.306(a)(1), 164.306(a)(2), 164.306(a)(3), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(c)(1), 164.530(i)(1), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)
    PM-2Information Security Program Leadership RolePMProgram Management5.1, 5.3164.308(a)(2)
    PM-6Measures of PerformancePMProgram Management5.1, 5.3, 9.1164.308(a)(2)
    PM-8Critical Infrastructure PlanPMProgram Management4.1, 9.1, 9.2.1, 9.2.2164.306(c), 164.306(d)(1), 164.306(d)(2), 164.308(a)(7)(i), 164.308(a)(7)(ii)(C), 164.314(a)(1), 164.314(a)(2)(ii), 164.504(g)(1), 164.530(i)(1)
    PM-9Risk Management StrategyPMProgram Management6.1.1, 6.1.2, 8.2164.306(a)(3), 164.306(b)(2)(iv)
    PM-13Security and Privacy WorkforcePMProgram Management5.3, 7.3, 7.4164.308(a)(3)(ii)(B), 164.308(a)(5)(i), 164.310(a)(2)(i), 164.312(a)(1), 164.530(a)(2)
    PM-14Testing, Training, and MonitoringPMProgram Management10.1, 8.1164.306(d)(3)(i), 164.316(b)(2)(iii)
    PM-28Risk FramingPMProgram Management6.1.2164.306(b)(2)(iv)
    PM-29Risk Management Program Leadership RolesPMProgram Management5.1, 5.3, 6.1.1, 6.1.2, 8.2164.306(a)(3), 164.306(b)(2)(iv), 164.308(a)(2)
    PT-1Policy and ProceduresPTPII Processing and Transparency5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.306(b)(1), 164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.502(a), 164.530(a)(1)(i), 164.530(i)(1), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(i)(4)(i)(A), 164.530(i)(4)(i)(B), 164.530(i)(5), 164.530(i)(5)(i), 164.530(i)(5)(ii), 164.530(j)(1)(i)
    SR-1Policy and ProceduresSRSupply Chain Risk Management5.1, 5.2, 7.5.1, 7.5.2, 7.5.3164.308(a)(1)(i), 164.308(a)(3)(i), 164.308(a)(4)(i), 164.308(a)(4)(ii)(A), 164.308(a)(6)(i), 164.308(a)(7)(i), 164.308(b)(1), 164.310(a)(1), 164.310(a)(2)(ii), 164.310(a)(2)(iv), 164.310(b), 164.310(d)(1), 164.310(d)(2)(i), 164.312(a)(1), 164.312(c)(1), 164.312(d), 164.316(a), 164.316(b)(1), 164.316(b)(2)(iii), 164.530(i)(2)(i), 164.530(i)(2)(ii), 164.530(i)(2)(iii), 164.530(i)(3), 164.530(j)(1)(i)

    Source and method

    Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.

    Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.

    Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.