NIST CSF crosswalk: how do you map CSF 2.0 to Reg S-P, GLBA and HIPAA?

A dual-registered firm answers to Regulation S-P. A tax practice answers to the FTC Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA), and may also be a HIPAA business associate if it serves medical clients. Each rule asks for a written program, and many firms end up maintaining two or three overlapping binders. A NIST CSF crosswalk built on the NIST Cybersecurity Framework (CSF) 2.0 lets a firm run one program and show each regulator the part it cares about.

Why use NIST CSF 2.0 as a crosswalk?

NIST CSF 2.0 works as a crosswalk because it is neutral, widely recognized and organized around outcomes, so each rule's requirements can be placed against it without rewriting the program. CSF 2.0 groups cybersecurity outcomes into six Functions (Govern, Identify, Protect, Detect, Respond and Recover), each divided into Categories such as GV.SC for supply chain risk management and ID.AM for asset management.

The framework is voluntary. It does not replace any rule, and following it is not compliance by itself. Its value is as a common index: a control is documented once, then tagged with every rule it helps satisfy.

If you have not set your starting point yet, begin with a current and target CSF profile, and see how the Govern function supports board oversight.

Which rules does the crosswalk cover?

This crosswalk covers three rules that often apply to the same firm:

• Regulation S-P, 17 CFR 248.30, for SEC-registered advisers, broker-dealers and other covered institutions. The 2024 amendments added an incident response program, customer notification and service provider oversight. Compliance dates were December 3, 2025 for larger entities and June 3, 2026 for smaller ones.
• The FTC Safeguards Rule, 16 CFR 314.4, which implements GLBA's safeguards obligation for non-bank financial institutions such as tax preparers and mortgage brokers.
• The HIPAA Security Rule, 45 CFR Part 164, Subpart C, for covered entities and business associates that handle ePHI.

For HIPAA, NIST has already done much of the mapping. NIST SP 800-66 Rev. 2, published in February 2024, maps the Security Rule's standards and implementation specifications to CSF Subcategories and SP 800-53 Rev. 5 controls.

How do the three rules map to the Govern and Identify Functions?

The three rules map closely to Govern and Identify: all three require someone in charge, a risk assessment and an understanding of what you are protecting.

• GV.RR, roles and responsibilities: the Safeguards Rule's Qualified Individual under 314.4(a), the HIPAA security official under 164.308(a)(2), and the person who owns the Reg S-P policies.
• GV.OV, oversight: the Safeguards Rule's written report to the board or a senior officer at least annually under 314.4(i).
• GV.SC, supply chain risk management: vendor selection and contracts under 314.4(f), Reg S-P service provider oversight under 248.30(a)(5), and HIPAA business associate agreements under 164.308(b) and 164.314(a).
• ID.AM, asset management: identifying and managing data, devices, systems and facilities under 314.4(c)(2), and knowing where ePHI is stored, received, maintained or transmitted for the HIPAA risk analysis.
• ID.RA, risk assessment: the written risk assessment under 314.4(b) and the HIPAA risk analysis under 164.308(a)(1)(ii)(A).
• ID.IM, improvement: evaluating and adjusting the program under 314.4(g) and the HIPAA evaluation under 164.308(a)(8).

How do they map to Protect and Detect?

Protect and Detect are where the three rules overlap most, although the Safeguards Rule is the most specific about technical controls.

• PR.AA, identity management and access control: access limited to authorized users under 314.4(c)(1), multifactor authentication for anyone accessing any information system under 314.4(c)(5), and HIPAA access control and person or entity authentication under 164.312(a) and (d).
• PR.DS, data security: encryption of customer information in transit and at rest under 314.4(c)(3), HIPAA encryption specifications, and secure disposal under 314.4(c)(6) and Reg S-P 248.30(b).
• PR.AT, awareness and training: security awareness training under 314.4(e) and HIPAA security awareness training under 164.308(a)(5).
• PR.PS, platform security: change management under 314.4(c)(7) and secure configuration generally.
• DE.CM, continuous monitoring: monitoring and logging of authorized users under 314.4(c)(8), HIPAA audit controls under 164.312(b), and the Safeguards Rule's testing under 314.4(d), which calls for annual penetration testing and vulnerability assessments at least every six months unless the firm monitors continuously.

How do they map to Respond and Recover?

All three rules map to Respond and Recover through a written incident plan, but their notice duties differ, and that is where a crosswalk needs care.

• RS.MA, incident management: Reg S-P's incident response program under 248.30(a)(3), which must be reasonably designed to detect, respond to and recover from unauthorized access to customer information; the Safeguards Rule's written incident response plan under 314.4(h); and HIPAA security incident procedures under 164.308(a)(6).
• RS.CO, incident response reporting and communication: Reg S-P customer notice as soon as practicable and no later than 30 days after becoming aware of the incident; FTC notice within 30 days of discovering a notification event involving at least 500 consumers under 314.4(j); and HIPAA breach notification under Subpart D.
• RC.RP, incident recovery plan execution: the HIPAA contingency plan under 164.308(a)(7), including data backup, disaster recovery and emergency mode operation.

What will a CSF crosswalk not cover?

It will not tell you every rule-specific deadline, threshold or record. Those need their own lines in the program, outside the framework:

• Notice clocks and audiences, which differ by rule. Reg S-P also requires service providers to notify the firm within 72 hours of becoming aware of a breach.
• Vendor contract terms that carry those clocks, covered in updating vendor contracts for Reg S-P service provider notice.
• Recordkeeping, such as the Reg S-P records under Rule 204-2(a)(25) for advisers and the six-year HIPAA documentation retention under 164.316(b).
• Scope tests, such as the Safeguards Rule's partial exemption for firms with fewer than 5,000 consumers under 314.6, or whether a firm is a business associate at all.
• Pending changes. The proposed HIPAA Security Rule update would add requirements, including a technology asset inventory and network map, that a crosswalk built today should flag as proposed.

A crosswalk is a working tool, and counsel should confirm how each rule applies to the firm.

What should your firm do this quarter?

Build the crosswalk once, then let it drive evidence collection. A practical sequence:

• List every rule that applies to the firm and the specific sections you are responsible for.
• Create one control register organized by CSF Function and Category.
• Tag each control with the rule sections it supports, using SP 800-66 Rev. 2 for the HIPAA mappings.
• Attach evidence to the control, not to the rule, so one MFA report or vendor review answers several requirements.
• Add a separate section for rule-specific deadlines, notices and records.

How does s90 help?

s90 maintains a single control register for firms that answer to more than one rule, mapped to CSF 2.0 and tagged by regulation, and keeps the evidence current for exams and client reviews. If you would like help building one, we are glad to start with your current policies.