First Data will be another big one for us! https:

Quote:

---

National Institute of Standards and Technology (NIST) Cybersecurity Framework
This crosswalk document identifies “mappings” between NIST’s Framework for Improving Critical Infrastructure Cybersecurity and the HIPAA Security Rule.

---

Quote:

---

The table below incorporates mappings of HIPAA Security Rule standards and implementation specifications to applicable NIST
Cybersecurity Framework Subcategories. These mappings are included in the “Relevant Control Mappings” column which also
includes mappings from other security frameworks. The other columns (“Function”, “Category”, and “Subcategory”) correlate
directly to the Function, Category and Subcategory Unique Identifiers defined within the NIST Cybersecurity Framework. Other
frameworks included in the mapping to the NIST Cybersecurity Framework include: the Council on Cybersecurity Critical Security
Controls (CCS CSC); Control Objectives for Information and Related Technology Edition 5 (COBIT 5); International Organization for
Standardization/ International Electrotechnical Commission (ISO/IEC) 27001; International Society of Automation (ISA) 62443;
National Institute of Standards and Technology (NIST) SP 800-53 Rev. 4.

---

Quote:

---

NIST Special Publication (SP) 800-53, Revision 4: Security and Privacy Controls for Federal Information Systems and Organizations

---

Quote:

---

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)
Organizations employ passwords, tokens, or biometrics to authenticate user identities, or in the case multifactor authentication, or some combination thereof. Access to organizational information systems is defined as either local access or network access.

(11) IDENTIFICATION AND AUTHENTICATION | REMOTE ACCESS - SEPARATE DEVICE The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [Assignment: organization-defined strength of mechanism requirements]. Supplemental Guidance: For remote access to privileged/non-privileged accounts, the purpose of requiring a device that is separate from the information system gaining access for one of the factors during multifactor authentication is to reduce the likelihood of compromising authentication credentials stored on the system

---