OpenControls Logo

STIG Viewer

STIGViewer Support
US Cybersecurity Documents/HIPAA Security Rule (45 CFR 164)/164.308

164.308(a)(7)(i)

paragraph (action item)

Standard: Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.

164.308 Administrative safeguards.

Related Frameworks

3 mappings across 5 frameworks
SCF3 mappings
BCD-01Business Continuity Management System (BCMS)
1.00
GOV-02Publishing Security, Compliance & Resilience Documentation
1.00
IRO-01Incident Response Operations
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-1Policy and Procedures
1.00
AC-14Permitted Actions Without Identification or Authentication
1.00
AC-2Account Management
1.00
AT-1Policy and Procedures
1.00
AT-2Literacy Training and Awareness
1.00
AT-3Role-based Training
1.00
AU-1Policy and Procedures
1.00
CA-1Policy and Procedures
1.00
CA-2Control Assessments
1.00
CA-5Plan of Action and Milestones
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.11.1
1.00
3.12.1
1.00
3.12.2
1.00
3.12.3
1.00
3.12.4
1.00
3.13.1
1.00
3.13.2
1.00
3.6.1
1.00
3.6.2
1.00
CCI0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CCI-000001
1.00
CCI-000002
1.00
CCI-000003
1.00
CCI-000004
1.00
CCI-000005
1.00
CCI-000006
1.00
CCI-000100
1.00
CCI-000101
1.00
CCI-000102
1.00
CCI-000103
1.00

+90 more (top 10 by confidence shown)

STIG0 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SV-222636r1051323_ruleA contingency plan must exist in accordance with DOD policy based on the application's availability requirements.
1.00
SV-222637r961863_ruleRecovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.
1.00
SV-223941r991589_ruleCA-TSS RECOVER Control Option must be set to ON.
0.50
SV-239862r953982_ruleThe Cisco ASA must be configured to send log data of denied traffic to a central audit server for analysis.
0.50
SV-243442r991589_ruleAdministrators of high-value IT resources must complete required training.
0.50
SV-251654r1028319_ruleCA IDMS must use pervasive encryption to cryptographically protect the confidentiality and integrity of all information at rest in accordance with data owner requirements.
0.50
SV-256877r958482_ruleIndividual user accounts with passwords must be maintained for the Hardware Management Console operating system and application.
0.50
SV-259903r948747_ruleAn inventory of authorized instruments must be documented and maintained in support of the detection of unauthorized instruments connected to the Enterprise Voice, Video, and Messaging system.
0.50
SV-259904r948748_ruleCustomers of the DISN VoSIP service must use address blocks assigned by the DRSN/VoSIP PMO.
0.50
SV-259905r948749_ruleVoice networks must not be bridged via a Unified Capability (UC) soft client accessory.
0.50

+3 more (top 10 by confidence shown)

Department of Health and Human Services, HIPAA Security and Privacy Rules (45 CFR Part 164). Edition dated 2026-01-01. Read the publication.