All frameworks US HHS

HIPAA Security Rule (45 CFR Part 164, Subpart C)

Technical, physical, and administrative safeguards for electronic protected health information. Mappings here are to the CURRENT rule in force. The December 2024 NPRM would add an explicit MFA mandate and remove the "addressable" status from encryption — but it is still a proposed rule: OCR received ~5,000 comments, and the federal agenda now shows final action no earlier than July 2027. Nothing on this page treats the proposal as a requirement.

Covered entities, business associates, health-tech vendors

13

control domains mapped

48

products applicable

11

other frameworks cross-mapped

HIPAA Security Rule (45 CFR Part 164, Subpart C)

§164.312(d) Person or entity authentication

Phishing-resistant MFA using hardware security keys. Software TOTP and SMS are explicitly excluded from "phishing-resistant" in NIST 800-63B and most modern framework guidance.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Amazon affiliate YubiKey Developer board Nitrokey 3A NFC Hacker $100

Same control in other frameworks:

NIST 800-53 IA-2(6) NIST CSF 2.0 PR.AA-03 ISO 27001 A.8.5 SOC 2 CC6.1 NIS2 Art.21(2)(i) CMMC 2.0 IA.L2-3.5.3 CIS Controls v8 CIS-6.3 PCI DSS 4.0.1 8.4.2 DORA Art. 9(4)(d) Essential Eight E8-MFA Cyber Essentials CE-4

§164.312(a)(2)(iv) Encryption and decryption (addressable)

Hardware-bound key generation and storage. Private keys generated and stored inside a certified secure element (EAL 6+) and are non-exportable by design — for login credentials (Nitrokey) and crypto-asset custody (Ledger) alike.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardware wallet Ledger Stax $399 Hardware wallet Ledger Flex $249 Hardware wallet Ledger Nano Gen5 $179 Hardware wallet Ledger Nano X $99 Hardware wallet Ledger Nano S Plus $59 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Amazon affiliate YubiKey

Same control in other frameworks:

NIST 800-53 SC-12 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.10 CIS Controls v8 CIS-3.11 PCI DSS 4.0.1 3.7.1 DORA Art. 9(4)(d)

§164.310(d)(1) Device and media controls

Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Hardened phone NitroPhone 10a $810 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 AC-19 NIST CSF 2.0 PR.AC-3 ISO 27001 A.8.1 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 AC.L2-3.1.18 CIS Controls v8 CIS-4.4 PCI DSS 4.0.1 1.5.1 Cyber Essentials CE-2

§164.312(c)(1) Integrity — protect ePHI from improper alteration or destruction

Measured boot chain verified on every power-on. Any firmware modification — supply chain implant, evil-maid attack, or malicious update — fails attestation before the OS loads.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure desktop NitroPC 2 $1,085 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 SI-7 NIST CSF 2.0 DE.CM-09 ISO 27001 A.8.8 SOC 2 CC7.1 NIS2 Art.21(2)(e) CMMC 2.0 SI.L2-3.14.6 CIS Controls v8 CIS-2.3 PCI DSS 4.0.1 11.5.2 DORA Art. 9(2) Cyber Essentials CE-2

§164.312(a)(1) Access control — technical policies limiting access to authorized persons

VM-level compartmentalization means a compromise of one domain (e.g. browser) cannot reach another (e.g. keys, vault). No other consumer laptop provides this by default.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-3 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.6 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.3 CIS Controls v8 CIS-12.2 PCI DSS 4.0.1 2.2.1 DORA Art. 9(4)(c)

§164.312(e)(1) Transmission security

Stateful firewall with IPS at the network perimeter. All inbound/outbound traffic inspected with Suricata rule sets. VPN gateway replaces consumer VPN dependency.

Products that satisfy this control:

Network security NitroWall V1410 $835 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Network Network appliances DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 SC-7 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.7 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.1 CIS Controls v8 CIS-12.3 PCI DSS 4.0.1 1.4.1 DORA Art. 9(4)(b) Cyber Essentials CE-1

§164.312(a)(2)(iv) Encryption and decryption (addressable)

Hardware-encrypted storage and self-hosted file servers replace cloud storage with hardware you control. Encryption keys never leave your environment.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure storage NextBox NAS $450 Hardware security module Nitrokey HSM 2 $135 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure storage Nitrokey Storage 2 (64 GB) $250 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-28 NIST CSF 2.0 PR.DS-01 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.16 CIS Controls v8 CIS-3.11 PCI DSS 4.0.1 3.5.1 DORA Art. 9(2)

§164.308(b)(1) Business associate contracts and other arrangements

Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Secure storage Nitrokey Storage 2 (64 GB) $250 Hardened phone NitroPhone 10a $810 Secure desktop NitroPC 2 $1,085 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SR-3 NIST CSF 2.0 GV.SC-06 ISO 27001 A.5.19 SOC 2 CC9.2 NIS2 Art.21(2)(d) CMMC 2.0 CM.L2-3.4.1 CIS Controls v8 CIS-15.1 PCI DSS 4.0.1 12.8.1 DORA Art. 28

§164.310(d)(1) Device and media controls — receipt and removal of hardware

Intel Management Engine disabled at the firmware level across every open-firmware machine we carry (NitroPad, NitroPC, PrivacyGuard, SecurityTitan); SecurityTitan models go further — camera and microphone physically removed, anti-tamper seals verified by Heads + Nitrokey attestation. Least functionality, enforced in hardware.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Secure desktop NitroPC Pro 2 $2,230 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Accessory Data blocker (USB-C/C) $15 Accessory Data blocker (USB-A/C) $15 Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SC-42 NIST CSF 2.0 PR.PS-01 ISO 27001 A.8.9 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 CM.L2-3.4.6 CIS Controls v8 CIS-4.8 PCI DSS 4.0.1 9.5.1

§164.310(a)(1) Facility access controls

Rated safes and vaults protect physical assets, documents, and hardware backups with UL-certified burglary ratings — from UL 1037 RSC (residential) up to UL 687 TL-15/TL-30 vault-grade for insurance-mandated or enterprise specialty storage (the tier insurers and auditors recognize; see the ratings ladder on /safe). SecurityTitan laptops extend physical protection to devices in transit: glitter-sealed tamper-evident screws with photographic verification make case intrusion detectable.

Products that satisfy this control:

Physical Safe & vault Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Physical Tamper-evident & locks Signal blocking Faraday bags

Same control in other frameworks:

NIST 800-53 PE-3 NIST CSF 2.0 PR.AC-2 ISO 27001 A.7.1 SOC 2 CC6.4 NIS2 Art.21(2)(i) CMMC 2.0 PE.L1-3.10.1 CIS Controls v8 CIS-11.5 PCI DSS 4.0.1 9.4.1 DORA Art. 9(4)(c)

§164.310(d)(1) Device and media controls — storage of media containing ePHI

UL 72 fire-rated safes keep interiors under 350°F through 30-minute to 4-hour furnace exposure — plus explosion and 30-foot drop tests — so original records, storage media, seed-phrase plates, and offline backups survive a facility fire. Distinct from burglary protection: enterprises with records-retention or continuity obligations typically need BOTH ratings on one unit (dual-rated Gardall UL line or TL-rated composite safes — see /safe).

Products that satisfy this control:

Physical Safe & vault

Same control in other frameworks:

NIST 800-53 MP-4 NIST CSF 2.0 PR.IR-02 ISO 27001 A.7.5 SOC 2 A1.2 NIS2 Art.21(2)(c) CMMC 2.0 MP.L2-3.8.1 CIS Controls v8 CIS-11.3 Essential Eight E8-Backups

§164.308(a)(7)(ii)(C) Emergency mode operation plan

Encrypted LoRa mesh radios (Meshtastic / MeshCore / Reticulum) move text and GPS with no cellular, WiFi, internet, or subscription — every node relays for every other, on FCC Part 15 unlicensed 915 MHz spectrum. The out-of-band channel for disaster response, incident communications when primary networks are down or untrusted, remote sites, and executive contingency plans.

Products that satisfy this control:

Off-grid comms LoRa mesh radios DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 CP-11 NIST CSF 2.0 RC.CO-04 ISO 27001 A.5.30 SOC 2 A1.3 NIS2 Art.21(2)(j) CMMC 2.0 IR.L2-3.6.1 CIS Controls v8 CIS-17 DORA Art. 11

§164.312(e)(2)(ii) Encryption in transit (addressable)

Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Network security NitroWall V1410 $835 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy Mullvad VPN Off-grid comms LoRa mesh radios

Same control in other frameworks:

NIST 800-53 SC-8 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.26 SOC 2 CC6.7 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.8 CIS Controls v8 CIS-3.10 PCI DSS 4.0.1 4.2.1 DORA Art. 9(2)

Also mapped to

NIST 800-53 US NIST CSF 2.0 US ISO 27001 Global SOC 2 US NIS2 EU CMMC 2.0 US DoD PCI DSS 4.0.1 Payments DORA EU Essential Eight AU Cyber Essentials UK CIS Controls v8 Global