Framework overlap

Does NAIC Insurance Data Security Model Law (MDL-668) cover API 1164?

You hold NAIC Insurance Data Security Model Law (MDL-668) and have been told to do API 1164. Here is how much overlaps, control by control.

63% of API 1164 you already have

NAIC Insurance Data Security Model Law (MDL-668) already covers about 63% of API 1164, leaving 9 of 24 controls as genuinely new work.

Already covered 8 Likely covered 7 New work 9

What is genuinely new work

Nothing in NAIC Insurance Data Security Model Law (MDL-668) reaches these. This is the list to scope.

API1164-01
Scope and Applicability
API1164-03
Governance and Roles
API1164-04
Asset Inventory
API1164-08
Configuration Management
API1164-10
Malware Protection
API1164-12
Incident Response
API1164-15
Personnel Security
API1164-16
Supply Chain and Third Party
API1164-20
Program Review and Continuous Improvement
Show the 15 you already have
API1164-02
Risk Management Framework
API1164-06
Access Control
API1164-07
Remote Access
API1164-09
Patch and Vulnerability Management
API1164-17
Wireless and Field Communications
API1164-18
Field Device Security
API1164-19
Safety Instrumented Systems Interface
API1164-24
Vulnerability assessment for critical systems
API1164-05
Network Segmentation and Zones
API1164-11
Logging and Monitoring
API1164-13
Business Continuity and Recovery
API1164-14
Physical Security
API1164-21
TSA Pipeline Security Directive Alignment
API1164-22
Configuration management for OT systems
API1164-23
Change management procedures

How this is calculated

Already covered means a mapping runs from a control in NAIC Insurance Data Security Model Law (MDL-668) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition