SOC 2 Type II to HITRUST CSF v11 control mapping
SOC 2 Type II and HITRUST CSF v11 both map to 81 NIST SP 800-53 controls. Every one is listed below, with the controls on each side that map to it.
- Shared NIST 800-53 controls
- 81
- SOC 2 Type II controls involved
- 46
- HITRUST CSF v11 controls involved
- 78
- NIST 800-53 families touched
- 17
How this pairing is derived
Both frameworks are mapped to NIST SP 800-53 Rev 5 in the source dataset, so the ground they share is the set of NIST controls they both reference. That set is what the table shows. It is not an authored SOC 2 Type II to HITRUST CSF v11 crosswalk: two controls on the same row are related through the NIST control between them, not asserted to be equivalent to each other.
Shared controls in full
| NIST 800-53 control | Family | SOC 2 Type II controls | HITRUST CSF v11 controls |
|---|---|---|---|
| AC-1Policy and Procedures | ACAccess Control | CC5.3, CC6.1, CC6.6 | HITRUST-01.c |
| AC-2Account Management | ACAccess Control | CC6.1, CC6.6 | HITRUST-01.d, HITRUST-01.h, HITRUST-01.p |
| AC-3Access Enforcement | ACAccess Control | CC6.1, CC6.6 | HITRUST-01.c, HITRUST-01.i, HITRUST-01.p |
| AC-4Information Flow Enforcement | ACAccess Control | CC6.1, CC6.6 | HITRUST-01.c |
| AC-5Separation of Duties | ACAccess Control | CC5.1, CC6.6 | HITRUST-01.h, HITRUST-01.j, HITRUST-09.c |
| AC-6Least Privilege | ACAccess Control | CC6.1 | HITRUST-01.i, HITRUST-01.j |
| AC-17Remote Access | ACAccess Control | CC6.6 | HITRUST-01.c, HITRUST-01.n, HITRUST-01.o, HITRUST-01.r |
| AC-20Use of External Systems | ACAccess Control | CC6.7 | HITRUST-01.n, HITRUST-01.r |
| AU-1Policy and Procedures | AUAudit and Accountability | CC5.3, CC7.2 | HITRUST-09.aa |
| AU-2Event Logging | AUAudit and Accountability | CC7.2, CC7.3 | HITRUST-09.aa |
| AU-3Content of Audit Records | AUAudit and Accountability | PI1.4 | HITRUST-09.aa |
| AU-6Audit Record Review, Analysis, and Reporting | AUAudit and Accountability | CC7.2, CC7.3 | HITRUST-09.aa |
| AU-9Protection of Audit Information | AUAudit and Accountability | PI1.4, PI1.5 | HITRUST-09.aa |
| AU-11Audit Record Retention | AUAudit and Accountability | C1.2 | HITRUST-09.ab |
| AU-12Audit Record Generation | AUAudit and Accountability | CC7.2, CC7.3 | HITRUST-09.aa |
| CM-1Policy and Procedures | CMConfiguration Management | CC5.3, CC7.1 | HITRUST-09.a |
| CM-2Baseline Configuration | CMConfiguration Management | CC7.1, CC8.1 | HITRUST-06.d, HITRUST-10.h |
| CM-3Configuration Change Control | CMConfiguration Management | CC3.4, CC8.1 | HITRUST-06.d, HITRUST-09.b, HITRUST-10.i |
| CM-4Impact Analyses | CMConfiguration Management | CC3.4 | HITRUST-09.d |
| CM-6Configuration Settings | CMConfiguration Management | CC7.1, CC8.1 | HITRUST-06.d, HITRUST-10.h |
| CP-1Policy and Procedures | CPContingency Planning | A1.2, CC5.3, CC7.5, CC9.1 | HITRUST-12.a |
| CP-2Contingency Plan | CPContingency Planning | A1.2, CC7.5, CC9.1 | HITRUST-12.a, HITRUST-12.b |
| CP-4Contingency Plan Testing | CPContingency Planning | A1.3, CC7.5 | HITRUST-12.a |
| CP-6Alternate Storage Site | CPContingency Planning | A1.2 | HITRUST-12.b, HITRUST-12.c |
| CP-7Alternate Processing Site | CPContingency Planning | A1.2 | HITRUST-12.c |
| CP-9System Backup | CPContingency Planning | A1.2, CC7.5 | HITRUST-12.a |
| CP-10System Recovery and Reconstitution | CPContingency Planning | A1.2, CC7.5, CC9.1 | HITRUST-12.a |
| IA-1Policy and Procedures | IAIdentification and Authentication | CC5.3, CC6.1, CC6.6 | HITRUST-01.d |
| IA-2Identification and Authentication (Organizational Users) | IAIdentification and Authentication | CC6.1 | HITRUST-01.l, HITRUST-01.m |
| IA-4Identifier Management | IAIdentification and Authentication | CC6.1, CC6.6 | HITRUST-01.d |
| IA-5Authenticator Management | IAIdentification and Authentication | CC6.1 | HITRUST-01.d, HITRUST-01.k, HITRUST-01.l, HITRUST-01.t |
| IA-8Identification and Authentication (Non-organizational Users) | IAIdentification and Authentication | CC6.1 | HITRUST-01.m |
| IR-1Policy and Procedures | IRIncident Response | CC5.3, CC7.3, CC7.4 | HITRUST-11.a, HITRUST-11.c |
| IR-4Incident Handling | IRIncident Response | CC7.3, CC7.4 | HITRUST-11.a, HITRUST-11.c |
| IR-6Incident Reporting | IRIncident Response | CC2.3, CC7.4, P6.3, P6.7 | HITRUST-11.b, HITRUST-13.c |
| IR-8Incident Response Plan | IRIncident Response | CC7.3, CC7.4 | HITRUST-11.a |
| PE-1Policy and Procedures | PEPhysical and Environmental Protection | A1.2, CC5.3, CC6.4 | HITRUST-08.e |
| PE-3Physical Access Control | PEPhysical and Environmental Protection | CC6.4 | HITRUST-08.a, HITRUST-08.e |
| PE-9Power Equipment and Cabling | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.h |
| PE-10Emergency Shutoff | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.h |
| PE-11Emergency Power | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.d |
| PE-13Fire Protection | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.c, HITRUST-08.d |
| PE-14Environmental Controls | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.c, HITRUST-08.d |
| PE-16Delivery and Removal | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.f |
| PE-17Alternate Work Site | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.f |
| PE-18Location of System Components | PEPhysical and Environmental Protection | A1.2 | HITRUST-08.g |
| PL-1Policy and Procedures | PLPlanning | CC1.5, CC2.2, CC2.3, CC3.1, CC3.4, CC5.2, CC5.3, PI1.2, PI1.3 | HITRUST-01.a, HITRUST-01.b, HITRUST-01.e, HITRUST-01.g, HITRUST-04.b, HITRUST-09.a, HITRUST-10.a |
| PL-2System Security and Privacy Plans | PLPlanning | CC2.1, CC4.1 | HITRUST-01.a |
| PL-4Rules of Behavior | PLPlanning | CC1.1 | HITRUST-04.b |
| RA-1Policy and Procedures | RARisk Assessment | CC3.1, CC4.1, CC5.1, CC5.3, CC9.1 | HITRUST-03.a |
| RA-2Security Categorization | RARisk Assessment | CC3.2 | HITRUST-03.a |
| RA-3Risk Assessment | RARisk Assessment | A1.2, CC4.1, CC7.3 | HITRUST-03.a, HITRUST-03.b, HITRUST-03.c, HITRUST-05.j |
| RA-5Vulnerability Monitoring and Scanning | RARisk Assessment | CC7.1 | HITRUST-10.m |
| SA-3System Development Life Cycle | SASystem and Services Acquisition | CC5.2, CC8.1 | HITRUST-10.a |
| SA-4Acquisition Process | SASystem and Services Acquisition | CC3.3, CC3.4, CC5.2, CC9.1, CC9.2, P6.4, PI1.2, PI1.3 | HITRUST-05.a, HITRUST-05.b, HITRUST-05.c, HITRUST-05.i, HITRUST-05.k, HITRUST-09.e |
| SA-9External System Services | SASystem and Services Acquisition | CC3.3, P6.4 | HITRUST-05.a, HITRUST-05.i, HITRUST-05.j, HITRUST-09.e |
| SC-5Denial-of-service Protection | SCSystem and Communications Protection | A1.1 | HITRUST-09.m |
| SC-7Boundary Protection | SCSystem and Communications Protection | CC6.1, CC6.6, CC6.8 | HITRUST-09.m, HITRUST-09.n, HITRUST-09.q |
| SC-8Transmission Confidentiality and Integrity | SCSystem and Communications Protection | CC6.1, CC6.7 | HITRUST-09.m, HITRUST-09.n, HITRUST-09.o |
| SC-12Cryptographic Key Establishment and Management | SCSystem and Communications Protection | CC6.1 | HITRUST-09.s |
| SC-13Cryptographic Protection | SCSystem and Communications Protection | CC6.1, CC6.7 | HITRUST-09.r, HITRUST-09.s, HITRUST-13.d |
| SC-17Public Key Infrastructure Certificates | SCSystem and Communications Protection | CC6.1 | HITRUST-09.r |
| SC-28Protection of Information at Rest | SCSystem and Communications Protection | CC6.1, CC6.7 | HITRUST-09.v, HITRUST-13.d |
| SI-3Malicious Code Protection | SISystem and Information Integrity | CC6.6, CC6.8 | HITRUST-06.e, HITRUST-06.f |
| SI-4System Monitoring | SISystem and Information Integrity | CC6.6, CC7.2, CC7.3 | HITRUST-06.f, HITRUST-09.p, HITRUST-10.l |
| SI-5Security Alerts, Advisories, and Directives | SISystem and Information Integrity | CC6.6 | HITRUST-10.m |
| SI-10Information Input Validation | SISystem and Information Integrity | CC6.6 | HITRUST-10.b, HITRUST-10.c, HITRUST-10.d |
| SI-12Information Management and Retention | SISystem and Information Integrity | C1.2, CC6.5, P4.2, P4.3, PI1.5 | HITRUST-13.b |
| MP-1Policy and Procedures | MPMedia Protection | C1.1, CC2.1, CC5.3, CC6.5, CC6.7, PI1.5 | HITRUST-07.a |
| MP-2Media Access | MPMedia Protection | C1.1 | HITRUST-07.a |
| MP-6Media Sanitization | MPMedia Protection | CC6.5, P4.3 | HITRUST-07.b, HITRUST-07.c |
| PS-1Policy and Procedures | PSPersonnel Security | CC1.1, CC1.4, CC5.3 | HITRUST-02.a |
| PS-4Personnel Termination | PSPersonnel Security | CC1.5 | HITRUST-02.e, HITRUST-02.f, HITRUST-02.g |
| PS-5Personnel Transfer | PSPersonnel Security | CC1.5 | HITRUST-02.e, HITRUST-02.f |
| PM-1Information Security Program Plan | PMProgram Management | CC1.1, CC1.2, CC5.3 | HITRUST-04.a |
| PM-2Information Security Program Leadership Role | PMProgram Management | CC1.1, CC1.3 | HITRUST-01.e |
| PM-9Risk Management Strategy | PMProgram Management | CC3.1, CC4.1, CC5.1, CC9.1 | HITRUST-04.a, HITRUST-05.b |
| PT-1Policy and Procedures | PTPII Processing and Transparency | CC2.2, CC3.2, CC5.1, CC5.2, CC5.3 | HITRUST-13.a |
| PT-2Authority to Process Personally Identifiable Information | PTPII Processing and Transparency | P3.1, P4.1 | HITRUST-13.a |
| PT-3Personally Identifiable Information Processing Purposes | PTPII Processing and Transparency | P4.1 | HITRUST-13.a, HITRUST-13.b |
| SR-1Policy and Procedures | SRSupply Chain Risk Management | CC3.3, CC5.3, CC9.1, CC9.2 | HITRUST-05.k |
Source and method
Derived from the Top Floor framework mapping dataset: 4,123 cross-framework control mappings across 19 frameworks, every one pivoted through NIST SP 800-53 Rev 5.
Cross-framework mappings on this page are derived from the 2026.2 release of the Secure Controls Framework, used under CC BY-ND 4.0.
Mappings are illustrative aids for planning and are not a substitute for the official text of any framework or for an assessor’s judgment. Always verify control requirements against the authoritative publication. Where no official crosswalk exists, the mapping judgment is our own analysis.
Related pairings
- SOC 2 Type II to NIST SP 800-53 Rev 5 control mapping301 shared controls
- SOC 2 Type II to PCI DSS v4.0.1 control mapping185 shared controls
- SOC 2 Type II to NIST CSF 2.0 control mapping175 shared controls
- SOC 2 Type II to HIPAA (Security, Privacy and Breach Notification Rules) control mapping132 shared controls
- SOC 2 Type II to CMMC Level 2 control mapping114 shared controls
- SOC 2 Type II to NIST SP 800-171 Rev 2 control mapping114 shared controls