Frameworks and Connectors
HIPAA Security Rule and connectors
Which connectors provide evidence for HIPAA Security Rule, for which controls, and how to connect them.
Safeguard's automated tests map to 14 controls of HIPAA Security Rule (45 CFR Part 164, Subpart C). 675 tests apply: 640 read a connected system, and 35 read Safeguard's own records (policies, people, training and devices), so they need no connector. A passing result is evidence toward a control, not proof that the control is met on its own.
In the framework library: HIPAA Security Rule, with what a scan checks, the controls and the policy templates.
How to connect for this framework
- Connect the systems you run from the table below. Each connector links to its setup steps.
- Open the framework on Compliance › Frameworks, then its Connectors tab: it lists the connectors that answer this framework's tests, which of them you have connected, and whether each connection is healthy.
- Tests run on their schedule, or straight away with Run now on Compliance › Tests. A passing test counts toward its controls once its preview period has ended.
Automated tests are switched on per workspace by the Safeguard team.
Connectors with automated evidence (359)
| Connector | Controls it provides evidence for | Tests |
|---|---|---|
| Microsoft Azure (also Microsoft Entra ID, Azure Government) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1) | 134 |
| Google Cloud Platform | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1) | 100 |
| Oracle Cloud (also Oracle Cloud Government) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 64 |
| Amazon Web Services (also AWS GovCloud, AWS CodeCommit, AWS Inspector, Amazon CloudWatch, Amazon S3, AWS Security Hub) | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 81 |
| GitLab (also GitLab Issues, GitLab Self-Managed) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d) | 37 |
| Google Workspace (also Google Cloud Identity, Google SSO) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(b)(1), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 24 |
| OVHcloud | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 25 |
| GitHub (also GitHub Enterprise, GitHub Issues) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(6), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d) | 40 |
| Hetzner | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 15 |
| Alibaba Cloud | 164.308(a)(4), 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 19 |
| Auth0 (also Auth0 SSO) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 12 |
| JumpCloud (also JumpCloud MDM, JumpCloud SSO) | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 15 |
| MongoDB Atlas | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 8 |
| Okta (also Okta SSO) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 14 |
| Azure DevOps | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(6), 164.312(a)(1), 164.312(c)(1) | 25 |
| Bitbucket | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(c)(1), 164.312(d) | 18 |
| Cloudflare | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d), 164.312(e)(1) | 12 |
| IBM Cloud | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d), 164.312(e)(1) | 15 |
| Keycloak | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(b), 164.312(d) | 7 |
| Redis Cloud | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 8 |
| StackRox (also Red Hat Advanced Cluster Security) | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(8), 164.312(b) | 10 |
| Supabase | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 7 |
| Claude (Anthropic) | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 7 |
| Codeberg | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(c)(1) | 6 |
| CrowdStrike Falcon | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6) | 15 |
| ElevenLabs | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 6 |
| Fireworks AI | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 8 |
| Fleet | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 8 |
| Gitea | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(c)(1) | 6 |
| Heroku | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(d), 164.312(e)(1) | 7 |
| Infisical | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 8 |
| Jamf | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 9 |
| Kandji | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 8 |
| Kolide | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 8 |
| Kubernetes (also Gatekeeper OPA, Kyverno) | 164.308(a)(4), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 40 |
| Linode | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(d), 164.312(e)(1) | 6 |
| Microsoft Intune | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 10 |
| Mistral AI | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 7 |
| Mosyle | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 9 |
| OneLogin (also OneLogin SSO) | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(a)(1), 164.312(d) | 7 |
| OpenAI API Platform | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b), 164.312(d) | 8 |
| Scaleway | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(d), 164.312(e)(1) | 5 |
| Sentry | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(d) | 6 |
| Akamai | 164.308(a)(3), 164.308(a)(4), 164.312(d), 164.312(e)(1) | 5 |
| ChatGPT | 164.308(a)(3), 164.308(a)(4), 164.312(b), 164.312(d) | 5 |
| Cisco Meraki SM | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 8 |
| ClickHouse | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(a)(1) | 5 |
| Datadog (also Datadog CSM) | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(b) | 10 |
| Elastic Observability | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(b) | 6 |
| Fastly | 164.308(a)(3), 164.308(a)(4), 164.312(d), 164.312(e)(1) | 5 |
| Gerrit | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(c)(1) | 5 |
| Hugging Face | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(d) | 7 |
| Ivanti Neurons | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 8 |
| LogicMonitor | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6), 164.312(b) | 5 |
| ManageEngine | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 6 |
| Miradore | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 8 |
| Nextcloud | 164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(d) | 5 |
| NinjaOne | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 6 |
| OpenRouter | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(d) | 6 |
| PingOne (also Ping Identity) | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(d) | 6 |
| PlanetScale | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(d) | 5 |
| Red Hat OpenShift | 164.308(a)(4), 164.312(a)(1), 164.312(b), 164.312(d) | 4 |
| Render | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(d) | 5 |
| SentinelOne | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6) | 8 |
| ServiceNow | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 9 |
| SigNoz | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(b) | 7 |
| SimpleMDM | 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 5 |
| Snowflake | 164.308(a)(3), 164.308(a)(4), 164.312(d), 164.312(e)(1) | 5 |
| Sophos Intercept X | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6) | 9 |
| Splunk | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.312(b) | 5 |
| Sumo Logic | 164.308(a)(3), 164.308(a)(4), 164.312(b), 164.312(d) | 6 |
| UpCloud | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(e)(1) | 4 |
| VMware | 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b) | 6 |
| Vultr | 164.308(a)(3), 164.308(a)(4), 164.308(a)(7), 164.312(e)(1) | 5 |
| xAI | 164.308(a)(3), 164.308(a)(5), 164.312(b), 164.312(d) | 4 |
| Airtable | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Asana | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| Authentik | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 5 |
| Automox | 164.308(a)(1), 164.308(a)(5), 164.310(d)(1) | 4 |
| Backblaze | 164.308(a)(7), 164.312(a)(1), 164.312(e)(1) | 3 |
| Cisco Secure Endpoint | 164.308(a)(1), 164.308(a)(5), 164.308(a)(6) | 6 |
| ClickUp | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| Cloudflare Access | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 3 |
| Coralogix | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 3 |
| Docker | 164.308(a)(3), 164.308(a)(4), 164.312(a)(1) | 4 |
| Duo Security | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 6 |
| Dynatrace | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 3 |
| Fly.io | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| FusionAuth | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| GoDaddy | 164.308(a)(3), 164.312(d), 164.312(e)(1) | 3 |
| Grafana | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| Hexnode | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1) | 5 |
| IBM Verify | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Instana | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 3 |
| Jira | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 9 |
| Linear | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 9 |
| Logto | 164.308(a)(4), 164.308(a)(5), 164.312(d) | 4 |
| Logz.io | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 5 |
| Looker | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Mailgun | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Make | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Mattermost | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Microsoft Defender for Endpoint | 164.308(a)(1), 164.308(a)(5), 164.308(a)(6) | 12 |
| MinIO | 164.308(a)(7), 164.312(a)(1), 164.312(e)(1) | 3 |
| Monday.com | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| New Relic | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| OpenStack | 164.308(a)(4), 164.308(a)(7), 164.312(a)(1) | 4 |
| Opsgenie Alerts | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 5 |
| Oracle Identity | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 5 |
| ownCloud | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PagerDuty | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 6 |
| Platform.sh | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Proxmox | 164.308(a)(4), 164.308(a)(7), 164.312(d) | 3 |
| Railway | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Rollbar | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| Salesforce | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Shortcut | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| Site24x7 | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| Slack | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| SolarWinds Service Desk | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| Spaceship | 164.308(a)(3), 164.312(d), 164.312(e)(1) | 3 |
| Terraform Cloud | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Vercel | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| VMware Workspace ONE | 164.308(a)(5), 164.310(d)(1), 164.312(a)(1) | 7 |
| YouTrack | 164.308(a)(3), 164.308(a)(4), 164.308(a)(6) | 8 |
| Zabbix | 164.308(a)(3), 164.308(a)(4), 164.312(b) | 4 |
| Zendesk | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Zitadel | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| Zoom | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| 15Five | 164.308(a)(3), 164.308(a)(4) | 2 |
| 1Password | 164.308(a)(3), 164.308(a)(4) | 2 |
| Action1 | 164.308(a)(5), 164.310(d)(1) | 2 |
| ActiveCampaign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Adobe Acrobat Sign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Aha! | 164.308(a)(3), 164.308(a)(4) | 3 |
| Airbyte | 164.308(a)(3), 164.308(a)(4) | 3 |
| Aircall | 164.308(a)(3), 164.308(a)(4) | 2 |
| Amplitude | 164.308(a)(3), 164.308(a)(4) | 2 |
| Ansible | 164.308(a)(3), 164.308(a)(4) | 3 |
| Apollo IO | 164.308(a)(3), 164.308(a)(4) | 2 |
| Aptible | 164.308(a)(3), 164.308(a)(4) | 3 |
| Ashby | 164.308(a)(3), 164.308(a)(4) | 3 |
| Assembla | 164.308(a)(3), 164.308(a)(4) | 3 |
| Attio | 164.308(a)(3), 164.308(a)(4) | 3 |
| Baramundi | 164.308(a)(5), 164.310(d)(1) | 4 |
| Basecamp | 164.308(a)(3), 164.308(a)(4) | 3 |
| Beanstalk | 164.308(a)(3), 164.308(a)(4) | 3 |
| Better Stack | 164.308(a)(6), 164.312(b) | 3 |
| Beyond Identity | 164.308(a)(3), 164.308(a)(4) | 2 |
| Bitdefender GravityZone | 164.308(a)(5), 164.308(a)(6) | 5 |
| BoldSign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Box | 164.308(a)(3), 164.308(a)(4) | 3 |
| Brex | 164.308(a)(3), 164.308(a)(4) | 2 |
| Canva | 164.308(a)(3), 164.308(a)(4) | 2 |
| Capsule | 164.308(a)(3), 164.308(a)(4) | 2 |
| Census | 164.308(a)(3), 164.308(a)(4) | 3 |
| Citrix Endpoint Management | 164.308(a)(5), 164.310(d)(1) | 5 |
| Citrix ShareFile | 164.308(a)(3), 164.308(a)(4) | 3 |
| Close | 164.308(a)(3), 164.308(a)(4) | 3 |
| Cobalt | 164.308(a)(1), 164.308(a)(8) | 3 |
| Confluence | 164.308(a)(3), 164.308(a)(4) | 2 |
| Copper | 164.308(a)(3), 164.308(a)(4) | 2 |
| Cortex XDR | 164.308(a)(5), 164.308(a)(6) | 5 |
| Coupa | 164.308(a)(3), 164.308(a)(4) | 3 |
| Culture Amp | 164.308(a)(3), 164.308(a)(4) | 2 |
| Cybereason | 164.308(a)(5), 164.308(a)(6) | 5 |
| Databricks | 164.308(a)(3), 164.308(a)(4) | 3 |
| dbt Cloud | 164.308(a)(3), 164.308(a)(4) | 2 |
| Deep Instinct | 164.308(a)(5), 164.308(a)(6) | 4 |
| Dialpad | 164.308(a)(3), 164.308(a)(4) | 3 |
| DigitalOcean | 164.308(a)(7), 164.312(e)(1) | 7 |
| DocuSign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Dropbox | 164.308(a)(3), 164.308(a)(4) | 3 |
| Dropbox Sign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Egnyte | 164.308(a)(3), 164.308(a)(4) | 3 |
| Elastic Security | 164.308(a)(5), 164.308(a)(6) | 5 |
| env0 | 164.308(a)(3), 164.308(a)(4) | 3 |
| ESET Protect | 164.308(a)(5), 164.308(a)(6) | 4 |
| Esper | 164.308(a)(5), 164.310(d)(1) | 2 |
| Figma | 164.308(a)(3), 164.308(a)(4) | 3 |
| Fivetran | 164.308(a)(3), 164.308(a)(4) | 3 |
| folk | 164.308(a)(3), 164.308(a)(4) | 2 |
| ForgeRock | 164.308(a)(3), 164.308(a)(4) | 2 |
| Fortinet FortiEDR | 164.308(a)(5), 164.308(a)(6) | 5 |
| Freshdesk | 164.308(a)(3), 164.308(a)(4) | 3 |
| Freshservice | 164.308(a)(3), 164.308(a)(6) | 4 |
| Front | 164.308(a)(3), 164.308(a)(4) | 3 |
| GoHighLevel | 164.308(a)(3), 164.308(a)(4) | 3 |
| GoTo Connect | 164.308(a)(3), 164.308(a)(4) | 3 |
| Greenhouse | 164.308(a)(3), 164.308(a)(4) | 3 |
| Gusto | 164.308(a)(3), 164.308(a)(4) | 2 |
| HashiCorp Consul | 164.312(a)(1), 164.312(e)(1) | 2 |
| HashiCorp Nomad | 164.312(a)(1), 164.312(e)(1) | 2 |
| HashiCorp Vault | 164.312(b), 164.312(d) | 2 |
| Hevo Data | 164.308(a)(3), 164.308(a)(4) | 3 |
| Hightouch | 164.308(a)(3), 164.308(a)(4) | 2 |
| Hive | 164.308(a)(3), 164.308(a)(4) | 2 |
| HubSpot | 164.308(a)(3), 164.308(a)(4) | 3 |
| Huntress | 164.308(a)(5), 164.308(a)(6) | 6 |
| Insightly | 164.308(a)(3), 164.308(a)(4) | 3 |
| Intercom | 164.308(a)(3), 164.308(a)(4) | 2 |
| Ironclad | 164.308(a)(3), 164.308(a)(4) | 2 |
| Jamf Protect | 164.308(a)(5), 164.308(a)(6) | 4 |
| Jira Service Management | 164.308(a)(1), 164.308(a)(6) | 3 |
| Kaspersky Endpoint | 164.308(a)(5), 164.308(a)(6) | 5 |
| Keap | 164.308(a)(3), 164.308(a)(4) | 3 |
| Lattice | 164.308(a)(3), 164.308(a)(4) | 2 |
| Launchpad | 164.308(a)(3), 164.308(a)(4) | 2 |
| Lever | 164.308(a)(3), 164.308(a)(4) | 3 |
| Loopio | 164.308(a)(3), 164.308(a)(4) | 3 |
| Microsoft Dynamics 365 | 164.308(a)(3), 164.308(a)(4) | 3 |
| Miro | 164.308(a)(3), 164.308(a)(4) | 2 |
| Mixpanel | 164.308(a)(3), 164.308(a)(4) | 2 |
| n8n | 164.308(a)(3), 164.308(a)(4) | 3 |
| Netlify | 164.308(a)(3), 164.308(a)(4) | 3 |
| Northflank | 164.308(a)(3), 164.308(a)(4) | 2 |
| Notion | 164.308(a)(3), 164.308(a)(4) | 2 |
| Nutanix | 164.308(a)(4), 164.308(a)(7) | 2 |
| Nutshell | 164.308(a)(3), 164.308(a)(4) | 3 |
| Oneflow | 164.308(a)(3), 164.308(a)(4) | 2 |
| OneSpan Sign | 164.308(a)(3), 164.308(a)(4) | 2 |
| OneTrust Vendorpedia | 164.308(a)(3), 164.308(a)(4) | 2 |
| Opal | 164.308(a)(3), 164.308(a)(4) | 2 |
| OpenPhone | 164.308(a)(3), 164.308(a)(4) | 3 |
| PandaDoc | 164.308(a)(3), 164.308(a)(4) | 3 |
| Pingdom | 164.308(a)(3), 164.308(a)(4) | 2 |
| Pipedrive | 164.308(a)(3), 164.308(a)(4) | 3 |
| Prey | 164.308(a)(5), 164.310(d)(1) | 2 |
| Productboard | 164.308(a)(3), 164.308(a)(4) | 3 |
| Pulumi (also Pulumi Cloud) | 164.308(a)(3), 164.308(a)(4) | 3 |
| Qovery | 164.308(a)(3), 164.308(a)(4) | 3 |
| Qualys EDR | 164.308(a)(5), 164.308(a)(6) | 3 |
| Ramp | 164.308(a)(3), 164.308(a)(4) | 3 |
| Rancher | 164.308(a)(3), 164.308(a)(4) | 3 |
| Red Canary | 164.308(a)(5), 164.308(a)(6) | 4 |
| Redmine | 164.308(a)(3), 164.308(a)(6) | 5 |
| RingCentral | 164.308(a)(3), 164.308(a)(4) | 3 |
| Rocket.Chat | 164.308(a)(3), 164.308(a)(4) | 3 |
| SailPoint | 164.308(a)(3), 164.308(a)(4) | 3 |
| Salesflare | 164.308(a)(3), 164.308(a)(4) | 2 |
| Segment | 164.308(a)(3), 164.308(a)(4) | 3 |
| SendGrid | 164.308(a)(3), 164.308(a)(4) | 3 |
| Setyl | 164.308(a)(3), 164.310(d)(1) | 2 |
| Shuffle | 164.308(a)(3), 164.308(a)(4) | 2 |
| SignNow | 164.308(a)(3), 164.308(a)(4) | 2 |
| SignRequest | 164.308(a)(3), 164.308(a)(4) | 3 |
| Smartsheet | 164.308(a)(3), 164.308(a)(4) | 3 |
| Spacelift | 164.308(a)(3), 164.308(a)(4) | 2 |
| Streak | 164.308(a)(3), 164.308(a)(4) | 2 |
| SugarCRM | 164.308(a)(3), 164.308(a)(4) | 3 |
| Symantec Endpoint | 164.308(a)(5), 164.308(a)(6) | 5 |
| Tanium | 164.308(a)(5), 164.308(a)(6) | 4 |
| Teamwork | 164.308(a)(3), 164.308(a)(4) | 3 |
| Telnyx | 164.308(a)(3), 164.308(a)(4) | 2 |
| ThreatConnect | 164.308(a)(3), 164.308(a)(4) | 2 |
| Tines | 164.308(a)(3), 164.308(a)(4) | 3 |
| Torii | 164.308(a)(3), 164.308(a)(4) | 2 |
| Tray.io | 164.308(a)(3), 164.308(a)(4) | 2 |
| Trellix | 164.308(a)(5), 164.308(a)(6) | 4 |
| Trello | 164.308(a)(3), 164.308(a)(4) | 3 |
| Trend Micro Apex One | 164.308(a)(5), 164.308(a)(6) | 5 |
| VMware Carbon Black | 164.308(a)(5), 164.308(a)(6) | 5 |
| Vtiger | 164.308(a)(3), 164.308(a)(4) | 3 |
| Wasabi | 164.308(a)(7), 164.312(e)(1) | 3 |
| Webex | 164.308(a)(3), 164.308(a)(4) | 3 |
| WithSecure | 164.308(a)(5), 164.308(a)(6) | 5 |
| Workable | 164.308(a)(3), 164.308(a)(4) | 3 |
| Workato | 164.308(a)(3), 164.308(a)(4) | 3 |
| Wrike | 164.308(a)(3), 164.308(a)(4) | 3 |
| Yousign | 164.308(a)(3), 164.308(a)(4) | 3 |
| Zendesk Sell | 164.308(a)(3), 164.308(a)(4) | 3 |
| Zoho CRM | 164.308(a)(3), 164.308(a)(4) | 3 |
| Zoho Desk | 164.308(a)(3), 164.308(a)(4) | 3 |
| 360Learning | 164.308(a)(5) | 1 |
| 42Gears | 164.310(d)(1) | 1 |
| Aikido Security | 164.308(a)(1) | 4 |
| Anchore | 164.308(a)(1) | 4 |
| AppDynamics | 164.312(b) | 1 |
| BambooHR | 164.308(a)(3) | 1 |
| BitSight | 164.308(a)(1) | 2 |
| Bright Security | 164.308(a)(1) | 4 |
| Bugcrowd | 164.308(a)(1) | 2 |
| Burp Suite | 164.308(a)(1) | 3 |
| Ceridian Dayforce | 164.308(a)(3) | 1 |
| Check Point CloudGuard | 164.308(a)(1) | 3 |
| Check Point Harmony | 164.308(a)(5) | 2 |
| Checkmarx | 164.308(a)(1) | 4 |
| Chronosphere | 164.312(b) | 1 |
| Civo | 164.312(e)(1) | 2 |
| Contrast Security | 164.308(a)(1) | 4 |
| Cortex XSOAR | 164.308(a)(6) | 2 |
| Cronitor | 164.312(b) | 1 |
| CrowdStrike Falcon Cloud | 164.308(a)(1) | 3 |
| D3 Security | 164.308(a)(6) | 2 |
| Deel | 164.308(a)(3) | 1 |
| Dependency-Track | 164.308(a)(1) | 4 |
| Detectify | 164.308(a)(1) | 3 |
| Docebo | 164.308(a)(5) | 1 |
| Employment Hero | 164.308(a)(3) | 1 |
| Endor Labs | 164.308(a)(1) | 4 |
| Escape | 164.308(a)(1) | 4 |
| Factorial | 164.308(a)(3) | 1 |
| Firebase | 164.312(a)(1) | 1 |
| GitGuardian | 164.308(a)(1) | 3 |
| Google Chronicle SOAR | 164.308(a)(6) | 2 |
| Google Drive | 164.312(a)(1) | 1 |
| HackerOne | 164.308(a)(1) | 2 |
| HiBob (also Bob) | 164.308(a)(3) | 1 |
| Humaans | 164.308(a)(3) | 1 |
| IBM QRadar SOAR | 164.308(a)(6) | 2 |
| Intruder | 164.308(a)(1) | 4 |
| Invicti | 164.308(a)(1) | 4 |
| JFrog Xray | 164.308(a)(1) | 3 |
| Lacework | 164.308(a)(1) | 3 |
| Lessonly | 164.308(a)(5) | 1 |
| Malwarebytes | 164.308(a)(5) | 3 |
| Mend | 164.308(a)(1) | 3 |
| Nucleus Security | 164.308(a)(1) | 4 |
| Ox Security | 164.308(a)(1) | 4 |
| Paychex | 164.308(a)(3) | 1 |
| Portainer | 164.308(a)(4) | 2 |
| Prisma Cloud | 164.308(a)(1) | 3 |
| Probely | 164.308(a)(1) | 4 |
| Prometheus | 164.312(b) | 1 |
| Proofpoint Security Awareness | 164.308(a)(5) | 2 |
| Prowler | 164.308(a)(1) | 2 |
| Qualys | 164.308(a)(1) | 4 |
| Rapid7 InsightIDR | 164.308(a)(6) | 2 |
| Rapid7 InsightVM | 164.308(a)(1) | 4 |
| Riot | 164.308(a)(5) | 2 |
| Rippling | 164.308(a)(3) | 1 |
| Sage HR | 164.308(a)(3) | 1 |
| SAP SuccessFactors | 164.308(a)(3) | 1 |
| Sapling | 164.308(a)(3) | 1 |
| SecurityScorecard Atlas | 164.308(a)(1) | 1 |
| Semgrep | 164.308(a)(1) | 4 |
| SharePoint | 164.312(a)(1) | 2 |
| Snyk | 164.308(a)(1) | 4 |
| Socket | 164.308(a)(1) | 3 |
| SonarQube | 164.308(a)(1) | 4 |
| Splunk SOAR | 164.308(a)(6) | 2 |
| StackHawk | 164.308(a)(1) | 3 |
| TalentLMS | 164.308(a)(5) | 1 |
| Tenable | 164.308(a)(1) | 4 |
| Torq | 164.308(a)(6) | 2 |
| Trend Micro Cloud One | 164.308(a)(1) | 3 |
| Turbot | 164.308(a)(1) | 1 |
| Udemy Business | 164.308(a)(5) | 1 |
| UKG | 164.308(a)(3) | 1 |
| UpGuard Vendor Risk | 164.308(a)(1) | 2 |
| Uptime Robot | 164.312(b) | 1 |
| Veracode | 164.308(a)(1) | 4 |
| Veza | 164.308(a)(4) | 1 |
| VictoriaMetrics | 164.312(b) | 1 |
| Webroot | 164.308(a)(5) | 2 |
| Wiz | 164.308(a)(1) | 3 |
| Workday | 164.308(a)(3) | 1 |
| Yardstik | 164.308(a)(3) | 1 |
| Zenefits | 164.308(a)(3) | 1 |
Evidence by attestation (95)
These systems publish no API for what the tests check. Connect them to record the connection, then attest the result; an accepted attestation counts toward the control.
| Connector | Controls |
|---|---|
| 8x8 | 164.308(a)(3) |
| Acunetix | 164.308(a)(1) |
| Addigy | 164.310(d)(1) |
| Affinity | 164.308(a)(3) |
| Airbase | 164.308(a)(3) |
| Apiiro | 164.308(a)(1) |
| Aqua Security | 164.308(a)(1) |
| Arctic Wolf | 164.308(a)(5) |
| Arnica | 164.308(a)(1) |
| Blackpoint Cyber | 164.308(a)(5) |
| Bugsnag | 164.308(a)(3) |
| Carta | 164.308(a)(3) |
| Checkmk | 164.308(a)(1), 164.308(a)(3) |
| Cloudanix | 164.308(a)(1) |
| Cohere | 164.308(a)(3) |
| Concord | 164.308(a)(3) |
| Contractbook | 164.308(a)(3) |
| ContractSafe | 164.308(a)(3) |
| CoreStack | 164.308(a)(1) |
| CyberArk | 164.308(a)(3), 164.312(d) |
| Cynet | 164.308(a)(5) |
| Cyscale | 164.308(a)(1) |
| Cyware | 164.308(a)(6) |
| DeepSeek | 164.308(a)(3) |
| Documenso | 164.308(a)(3) |
| Edgescan | 164.308(a)(1) |
| Eversign | 164.308(a)(3) |
| Evisort | 164.308(a)(3) |
| Foxit eSign | 164.308(a)(3) |
| Freshsales | 164.308(a)(3) |
| Gatekeeper | 164.308(a)(3) |
| GetAccept | 164.308(a)(3) |
| GitKraken | 164.308(a)(3) |
| Groq | 164.308(a)(3) |
| Honeycomb | 164.308(a)(1) |
| IBM MaaS360 | 164.310(d)(1) |
| IDrive | 164.308(a)(7) |
| Juro | 164.308(a)(3) |
| Kion | 164.308(a)(1) |
| LastPass SSO | 164.308(a)(3), 164.312(d) |
| Legit Security | 164.308(a)(1) |
| Lexion | 164.308(a)(3) |
| LinkSquares | 164.308(a)(3) |
| Lookout | 164.308(a)(5) |
| Matillion | 164.308(a)(3) |
| MessageBird | 164.308(a)(3) |
| Microsoft 365 Copilot | 164.308(a)(3) |
| Nagios | 164.308(a)(1) |
| Nessus | 164.308(a)(1) |
| Netdata | 164.308(a)(3) |
| Nextiva | 164.308(a)(3) |
| OpenVAS | 164.308(a)(1) |
| Orca Security | 164.308(a)(1) |
| pCloud | 164.308(a)(3) |
| Perplexity | 164.308(a)(3) |
| Phylum | 164.308(a)(1) |
| Pipedream | 164.308(a)(3) |
| Plivo | 164.308(a)(3) |
| Postmark | 164.308(a)(3) |
| Precoro | 164.308(a)(3) |
| Rapid7 InsightCloudSec | 164.308(a)(1) |
| Rapid7 InsightConnect | 164.308(a)(6) |
| Raygun | 164.308(a)(3) |
| Replicate | 164.308(a)(3) |
| Responsive | 164.308(a)(3) |
| RightSignature | 164.308(a)(3) |
| Rippling MDM | 164.310(d)(1) |
| RiskRecon | 164.308(a)(1) |
| RudderStack | 164.308(a)(3) |
| SAP Ariba | 164.308(a)(3) |
| Scalefusion | 164.310(d)(1) |
| Signable | 164.308(a)(3) |
| Signeasy | 164.308(a)(3) |
| SignWell | 164.308(a)(3) |
| Skribble | 164.308(a)(3) |
| Sonrai Security | 164.308(a)(1) |
| SOTI MobiControl | 164.310(d)(1) |
| SpotDraft | 164.308(a)(3) |
| Stitch | 164.308(a)(3) |
| Storj | 164.312(a)(1) |
| Stream Security | 164.308(a)(1) |
| Sweet Security | 164.308(a)(1) |
| Swimlane | 164.308(a)(6) |
| Sysdig | 164.308(a)(1) |
| Tenable Cloud Security | 164.308(a)(1) |
| Together AI | 164.308(a)(3) |
| Twilio | 164.308(a)(3) |
| Uptycs | 164.308(a)(1) |
| Vonage | 164.308(a)(3) |
| Wallarm | 164.308(a)(1) |
| Yotta | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) |
| Z.ai (Zhipu GLM) | 164.308(a)(3) |
| Zip | 164.308(a)(3) |
| Zoho Sign | 164.308(a)(3) |
| Zscaler Posture Control | 164.308(a)(1) |
Controls (14)
| Control | Title | Automated tests | Connectors |
|---|---|---|---|
164.308(a)(1) | Information system activity review | 101 | 114 |
164.308(a)(3) | Termination procedures | 23 | 312 |
164.308(a)(4) | Information access management | 76 | 245 |
164.308(a)(5) | Password management | 37 | 109 |
164.308(a)(6) | Response and reporting | 24 | 71 |
164.308(a)(7) | Data backup plan | 50 | 37 |
164.308(a)(8) | Evaluation | 3 | 3 |
164.308(b)(1) | Business associate contracts and other arrangements | 4 | 3 |
164.310(d)(1) | Device and media controls | 5 | 33 |
164.312(a)(1) | Access control | 147 | 74 |
164.312(b) | Audit controls | 79 | 70 |
164.312(c)(1) | Integrity | 8 | 15 |
164.312(d) | Person or entity authentication | 54 | 99 |
164.312(e)(1) | Transmission security | 65 | 55 |