Spreadsheet: 16a9ab76-86c2-4ee9-b5e2-a2e2cddfa0e9
Sheet: Compliance Mapping Reference

Control Objectives for Information and related Technology (COBIT®), Version 4.1 (2007)
Developed by the IT Governance Institute, COBIT is a framework and supporting tool to bridge the gap with respect to control requirements, technical issues and business risks, and communicate that level of control to stakeholders. COBIT enables the development of clear policies and good practice for IT control throughout enterprises. The process structure of COBIT and its high-level, business-oriented approach provide an end-to-end view of IT and the decisions to be made about IT.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules
The HIPAA Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes. The Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities to use to assure the confidentiality, integrity, and availability of electronic protected health information.
International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27002:2001 -- Information technology -- Security techniques -- Code of practice for Information Security Management
ISO/IEC 27002:2005 establishes guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization. The objectives outlined provide general guidance on the commonly accepted goals of information security management. ISO/IEC 27002:2005 contains best practices of control objectives and controls in the following areas of information security management:  • Security policy  • Organization of information security  • Asset management  • Human resources security  • Physical and environmental security  • Communications and operations management  • Access control  • Information systems acquisition, development and maintenance  • Information security incident management  • Business continuity management  • Compliance  ISO/IEC 27002:2005 comprises ISO/IEC 17799:2005 and ISO/IEC 17799:2005/Cor.1:2007. Its technical content is identical to that of ISO/IEC 17799:2005. ISO/IEC 17799:2005/Cor.1:2007 changes the reference number of the standard from 17799 to 27002.
National Institute of Technology (NIST) Special Publication 800-53 -- Recommended Security Controls for Federal Information Systems, Revision 2 (Dec 2007)
The purpose of this publication is to provide guidelines for selecting and specifying security controls for information systems supporting the executive agencies of the federal government. The guidelines apply to all components of an information system that process, store, or transmit federal information. The guidelines have been developed to help achieve more secure information systems within the federal government by:  • Facilitating a more consistent, comparable, and repeatable approach for selecting and specifying security controls for information systems;  • Providing a recommendation for minimum security controls for information systems categorized in accordance with Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems;  • Providing a stable, yet flexible catalog of security controls for information systems to meet current organizational protection needs and the demands of future protection needs based on changing requirements and technologies; and  • Creating a foundation for the development of assessment methods and procedures for determining security control effectiveness.
Payment Card Industry (PCI) Data Security Standard (DSS) Requirements and Security Assessment Procedures, Version 1.2 (Oct 2008)
The PCI DSS was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. This document, PCI Data Security Standard Requirements and Security Assessment Procedures, uses as its foundation the 12 PCI DSS requirements, and combines them with corresponding testing procedures into a security assessment tool. It is designed for use by assessors conducting onsite reviews for merchants and service providers who must validate compliance with the PCI DSS.
Other Compliance Resources (Mappings to be Considered for Future CSA CM Releases)
NIST Special Publications (800 Series)
International Standards  • ISO/IEC 27003:2010, Information technology -- Security techniques -- Information security management system implementation guidance  • ISO/IEC 27033-1:2009, Information technology -- Security techniques -- Network security -- Part 1: Overview and concepts  • ISO/IEC 19792:2009, Information technology -- Security techniques -- Security evaluation of biometrics  • ISO 31000:2009, Risk management -- Principles and guidelines  • ISO 9001:2008, Quality management systems -- Requirements  • ISO 14001:2004, Environmental management systems - Requirements with guidance for use  • ISO 27799:2008, Health informatics -- Information security management in health using ISO/IEC 27002  • BS 25999:2007, Business continuity management
Generally Accepted Privacy Principles (GAPP)
Health Information Technology for Economic and Clinical Health (HITECH) Act passed as part of the American Recovery and Reinvestment Act of 2009 (ARRA)
BITS Shared Assessments Program Agreed Upon Procedures (AUP) Version 5.0 Assessment Guide