Open source HIPAA compliance benchmark for AWS

Re:Open source HIPAA compliance benchmark for AWS by nathanwallace on Wednesday June 16, 2021 @09:51PM (#27535456)

That's exactly one of the use cases we are targeting. Beyond the standard benchmarks, Steampipe has a simple HCL + SQL language to write your own controls [1]. It feels like writing Terraform, but is for operational and security controls.

Hope you can give it a try, we'd love your feedback and suggestions!

1 - https://steampipe.io/docs/using-steampipe/writing-controls

[ Parent | on HN ]

Re:Open source HIPAA compliance benchmark for AWS by jollofricepeas on Thursday June 17, 2021 @01:32AM (#27536384)

Hmmm. The stuff for HIPAA isn’t great. If this is meant to actually be of value to covered entities and business associates then NIST CSF (and related) is the benchmark to use.

There are known gaps in HIPAA per OCR. The actual expectation is that entities identify these gaps under the annual risk management mandate thus the more frequently updated NIST is what’s preferred (or even HITRUST…yuck)

https://www.hhs.gov/hipaa/for-professionals/security/nist-se...

Feel free to check out OCRs resolution agreements as well for details. They are all online.

[ Parent | on HN ]

Re:Open source HIPAA compliance benchmark for AWS by nathanwallace on Thursday June 17, 2021 @09:43AM (#27539469)

Agree that adding NIST controls would be great - so far we've focused on CIS, PCI and HIPAA.

[ Parent | on HN ]

Re:Open source HIPAA compliance benchmark for AWS by jollofricepeas on Thursday June 17, 2021 @01:41AM (#27536410)

I haven’t seen many engineers who know the first thing about controls. But it’s literally most of what internal audit, compliance, privacy & risk people do.

How about an export feature from Archer or <name your internal audit tool here> that would save everyone a bunch of time and effort.

The other issue is that most of these client audits are a word or excel doc. Throwing your SOC back at them doesn’t work in most cases.

[ Parent | on HN ]