OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.308

164.308(a)(1)(ii)(D)

paragraph (action item)

Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

164.308 Administrative safeguards.

Related Frameworks

3 mappings across 5 frameworks
SCF3 mappings
IRO-09Situational Awareness For Incidents
1.00
MON-01Continuous Monitoring
1.00
MON-01.8Security Event Monitoring
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-2Account Management
1.00
AC-2(12)Account Monitoring for Atypical Usage
1.00
AC-4Information Flow Enforcement
1.00
AC-9Previous Logon Notification
1.00
AT-1Policy and Procedures
1.00
AU-1Policy and Procedures
1.00
AU-11Audit Record Retention
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (24) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.1
1.00
3.1.2
1.00
3.1.3
1.00
3.11.1
1.00
3.12.1
1.00
3.12.2
1.00
3.12.3
1.00
3.12.4
1.00
3.13.1
1.00
3.13.2
1.00

+14 more (top 10 by confidence shown)

CCI0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000008
1.00
CCI-000010
1.00
CCI-000011
1.00
CCI-000012
1.00
CCI-000117
1.00
CCI-000119
1.00
CCI-000120
1.00
CCI-000122
1.00
CCI-000274
1.00
CCI-000279
1.00

+90 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-251654r1028319_ruleCA IDMS must use pervasive encryption to cryptographically protect the confidentiality and integrity of all information at rest in accordance with data owner requirements.
1.00
SV-221778r958446_ruleThe Oracle Linux operating system must audit all uses of the chown, fchown, fchownat, and lchown syscalls.
0.50
SV-242442r961677_ruleKubernetes must remove old components after updated versions have been installed.
0.50
SV-251335r853642_ruleAn Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor all Demilitarized Zone (DMZ) segments housing public servers.
0.50
SV-251336r853643_ruleAn Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor the network segment hosting web, application, and database servers.
0.50
SV-251337r853644_ruleAn Intrusion Detection and Prevention System (IDPS) sensor must be deployed to monitor network segments that house network security management servers.
0.50
SV-251338r1007842_ruleAn Intrusion Detection and Prevention System (IDPS) must be deployed to monitor all unencrypted traffic entering and leaving the enclave.
0.50
SV-87757r1_ruleServers hosting SDN controllers must have an HIDS implemented to detect unauthorized changes.
0.50

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.