164.308(a)(1)(ii)(B) Risk Management (Required)
164.308(a)(1)(ii)(B) in HIPAA Security Rule (the HIPAA Security Rule as it currently stands). All HIPAA Security Rule controls held. Open HIPAA Security Rule on the standards site.
The control as we hold it
Risk Management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. NIST recommends prioritized treatment plans, residual risk acceptance by leadership, and continuous monitoring tied to NIST SP 800-137.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
SOC 2
- SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) (closest match)
- SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17) (closest match)
- SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) (closest match)
- SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities (closest match)
- SOC2-CC9.1 CC9.1 Mitigating risks of business disruption (closest match)
NIST SP 800-53 Rev 5
- NIST800-CA-5 CA-5 Plan of Action and Milestones (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-PM-9 PM-9 Risk Management Strategy (closest match)
- NIST800-PM-28 PM-28 Risk Framing (closest match)
- NIST800-PM-30 PM-30 Supply Chain Risk Management Strategy (closest match)
- NIST800-RA-7 RA-7 Risk Response (closest match)
- NIST800-SA-8 SA-8 Security and Privacy Engineering Principles (closest match)
- NIST800-SC-38 SC-38 Operations Security (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: Administrative), in our words, not a statement of the standard and not binding on an assessor.
- the risk analysis and risk-management records
- the workforce clearance, training and sanction records
- the access-authorisation and termination records
- the contingency-plan test and evaluation records