!"#$ &'(')*+*(, -.

"/* 012
3(012+',"1( 4*56(171)8 98#,*+#
Recommendations of the NationaI Institute of
Standards and TechnoIogy
Gary Stoneburner, Alice Goguen, and Alexis Feringa























Special Publication 800-30
SP 800-30 Page 9


Figure 3-1. Risk Assessment Methodology Flowchart
List oI Current and
Planned Controls
Step 4. Control Analysis
Threat Statement
Step 2.
Threat Identification
List oI Potential
Vulnerabilities
Step 3.
Vulnerability Identification
Reports Irom prior risk
assessments
Any audit comments
Security requirements
Security test results
Hardware
SoItware
System interIaces
Data and inIormation
People
System mission
Step 1.
System Characterization
Likelihood Rating Step 5.
Likelihood Determination
Threat-source motivation
Threat capacity
Nature oI vulnerability
Current controls
Step 9.
Results Documentation
Risk Assessment
Report
Step 6. Impact Analysis
Loss oI Integrity
Loss oI Availability
Loss oI ConIidentiality
Impact Rating
Mission impact analysis
Asset criticality assessment
Data criticality
Data sensitivity
Risks and
Associated Risk
Levels
Step 7. Risk Determination
Likelihood oI threat
exploitation
Magnitude oI impact
Adequacy oI planned or
current controls
Recommended
Controls
Step 8.
Control Recommendations
!"#$% &'() +((,((-,"% +.%'/'%',( 0$%#$%
System Boundary
System Functions
System and Data
Criticality
System and Data
Sensitivity
Current controls
Planned controls
History oI system attack
Data Irom intelligence
agencies, NIPC, OIG,
FedCIRC, mass media,
List oI Current and
Planned Controls
List oI Current and
Planned Controls
Step 4. Control Analysis
Threat Statement
Step 2.
Threat Identification
List oI Potential
Vulnerabilities
Step 3.
Vulnerability Identification
Reports Irom prior risk
assessments
Any audit comments
Security requirements
Security test results
Reports Irom prior risk
assessments
Any audit comments
Security requirements
Security test results
Hardware
SoItware
System interIaces
Data and inIormation
People
System mission
Step 1.
System Characterization
Likelihood Rating Step 5.
Likelihood Determination
Threat-source motivation
Threat capacity
Nature oI vulnerability
Current controls
Step 9.
Results Documentation
Risk Assessment
Report
Step 6. Impact Analysis
Loss oI Integrity
Loss oI Availability
Loss oI ConIidentiality
Impact Rating
Mission impact analysis
Asset criticality assessment
Data criticality
Data sensitivity
Risks and
Associated Risk
Levels
Step 7. Risk Determination
Likelihood oI threat
exploitation
Magnitude oI impact
Adequacy oI planned or
current controls
Recommended
Controls
Step 8.
Control Recommendations
!"#$% &'() +((,((-,"% +.%'/'%',( 0$%#$%
System Boundary
System Functions
System and Data
Criticality
System and Data
Sensitivity
Current controls
Planned controls
Current controls
Planned controls
History oI system attack
Data Irom intelligence
agencies, NIPC, OIG,
FedCIRC, mass media,
SP 800-30 Page 31













































Figure 4-2. Risk Mitigation Methodology Flowchart
List oI possible
controls
Step 2.
Evaluate Recommended
Control Options
Step 1.
Prioritize Actions
Risk levels Irom the
risk assessment
report
"#$%& '()* +(&(,-&(.# /0&(1(&(2) 3%&$%&
Actions ranking Irom
High to Low
Cost-beneIit
analysis
Step 3.
Conduct Cost-Benefit Analysis
Impact oI implementing
Impact oI not implementing
Associated costs
Feasibility
EIIectiveness
Risk assessment
report
Step 5.
Assign Responsibility
List oI
responsible persons
Step 6. Develop Safeguard
Implementation Plan
Risks and Associated Risk Levels
Prioritized Actions
Recommended Controls
Selected Planned Controls
Responsible Persons
Start Date
Target Completion Date
Maintenance Requirements
SaIeguard
implementation plan
Step 7.
Implement Selected
Controls
Residual Risks
Step 4.
Select Controls
Selected Controls

NIST Special Publication 800-66



An Introductory Resource Guide for
Implementing the Health Insurance
Portability and Accountability Act
(HIPAA) Security Rule

Joan Hash, Pauline Bowen, Arnold Johnson,
Carla Dancy Smith, Daniel I. Steinberg

I N F O R M A T I O N S E C U R I T Y


Computer Security Division
Information Technology Laboratory
National Institute of Standards and Technology
Gaithersburg, MD 20899-8930



March 2005









U.S. Department of Commerce
Carlos M. Gutierrez, Secretary
Technology Administration
Phillip J. Bond, Under Secretary of Commerce for Technology
National Institute of Standards and Technology
Hratch G. Semerjian, Jr., Acting Director

An Introductory Resource Guide for Implementing the HIPAA Security Rule
Table 1. NIST Publications Referenced in NIST SP 800-66
5
NIST Publication Title
FIPS 140-2 Security Requirements for Cryptographic Modules
FIPS 199 Standards for Security Categorization of Federal Information and
Information Systems
NIST SP 800-12 An Introduction to Computer Security: The NIST Handbook
NIST SP 800-14 Generally Accepted Principles and Practices for Securing Information
Technology Systems
NIST SP 800-16 Information Technology Security Training Requirements: A Role- And
Performance-Based Model
NIST SP 800-18 Guide for Developing Security Plans for Information Technology Systems
NIST SP 800-26 Security Self-Assessment Guide for Information Technology Systems
NIST SP 800-27 Engineering Principles for Information Technology Security (A Baseline for
Achieving Security)
NIST SP 800-30 Risk Management Guide for Information Technology Systems
NIST SP 800-34 Contingency Planning Guide for Information Technology Systems
NIST SP 800-35 Guide to Information Technology Security Services
NIST SP 800-36 Guide to Selecting Information Security Products
NIST SP 800-37 Guide for the Security Certification and Accreditation of Federal Information
Systems
NIST SP 800-42 Guideline on Network Security Testing
NIST SP 800-44 Guidelines on Securing Public Web Servers
NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems
NIST SP 800-50 Building an Information Technology Security Awareness and Training
Program
NIST SP 800-53 Recommended Security Controls for Federal Information Systems
NIST SP 800-55 Security Metrics Guide for Information Technology Systems
NIST SP 800-56 Recommendation on Key Establishment Schemes
NIST SP 800-57 Recommendation on Key Management
NIST SP 800-59 Guideline for Identifying an Information System as a National Security
System
NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to
Security Categories
NIST SP 800-61 Computer Security Incident Handling Guide
NIST SP 800-63 Electronic Authentication Guide: Recommendations of the National Institute
of Standards and Technology
NIST SP 800-64 Security Considerations in the Information System Development Life Cycle
NIST SP 800-65 Integrating Security into the Capital Planning and Investment Control
Process



5
Status and most current versions of the NIST documents (Draft or Final) can be found at http://csrc.nist.gov/publications.
SP 800-66 Page 6
An Introductory Resource Guide for Implementing the HIPAA Security Rule
Table 2. HIPAA Security Rule Standards and Implementation Specifications
10
Standards Sections
Implementation Specifications
(R)=Required (A)=Addressable
Administrative Safeguards
Security Management
Process
164.308(a)(1) Risk Analysis (R)
Risk Management (R)
Sanction Policy (R)
Information System
Activity Review (R)
Assigned Security
Responsibility
164.308(a)(2) [None]
Workforce Security 164.308(a)(3) Authorization and/or Supervision (A)
Workforce Clearance Procedure (A)
Termination Procedures (A)
Information Access
Management
!"#$%&'(a)(#) Isolating Health Care Clearinghouse Functions
(R)
Access Authorization (A)
Access Establishment and Modification (A)
Security Awareness and
Training
164.308(a)(5) Security Reminders (A)
Protection from Malicious Software (A)
Log-in Monitoring (A)
Password Management (A)
Security Incident Procedures 164.308(a)(6) Response and Reporting (R)
Contingency Plan 164.308(a)(7) Data Backup Plan (R)
Disaster Recovery Plan (R)
Emergency Mode Operation Plan (R)
Testing and Revision Procedures (A)
+,,-./01.234 035 6010 78.1./0-.19 +30-94.4
+)
Evaluation 164.308(a)(8) [None]
Business Associate Contracts
and Other Arrangements
164.308(b)(1) Written Contract or Other Arrangement (R)
Physical Safeguards
Facility Access Controls 164.310(a)(1) Contingency Operations (A)
Facility Security Plan (A)
Access Control and Validation Procedures (A)
Maintenance Records (A)
Workstation Use 164.310(b) [None]
Workstation Security 164.310(c) [None]
Device and Media Controls 164.310(d)(1) Disposal (R)
Media Re-use (R)
Accountability (A)
Data Backup and Storage
(A)
Technical Safeguards
Access Control 164.312(a)(1) Unique User
Identification (R)
Emergency Access
Procedure (R)
Automatic Logoff (A)
Encryption and
Decryption (A)
Audit Controls 164.312(b) [None]
Integrity 164.312(c)(1) Mechanism to Authenticate Electronic Protected
Health Information (A)
Person or Entity
Authentication
164.312(d) [None]
Transmission Security 164.312(e)(1) Integrity Controls (A) Encryption (A)

10
Adapted from 68 Federal Register 8380, February 20, 2003 (Appendix A to Subpart C of Part 164--Security Standards:
Matrix).
SP 800-66 Page 14