Framework overlap

Does OCC Heightened Standards (12 CFR Part 30, Appendix D) cover API 1164?

You hold OCC Heightened Standards (12 CFR Part 30, Appendix D) and have been told to do API 1164. Here is how much overlaps, control by control.

58% of API 1164 you already have

OCC Heightened Standards (12 CFR Part 30, Appendix D) already covers about 58% of API 1164, leaving 10 of 24 controls as genuinely new work.

Already covered 1 Likely covered 13 New work 10

What is genuinely new work

Nothing in OCC Heightened Standards (12 CFR Part 30, Appendix D) reaches these. This is the list to scope.

API1164-01
Scope and Applicability
API1164-03
Governance and Roles
API1164-04
Asset Inventory
API1164-05
Network Segmentation and Zones
API1164-08
Configuration Management
API1164-10
Malware Protection
API1164-11
Logging and Monitoring
API1164-15
Personnel Security
API1164-16
Supply Chain and Third Party
API1164-20
Program Review and Continuous Improvement
Show the 14 you already have
API1164-21
TSA Pipeline Security Directive Alignment
API1164-02
Risk Management Framework
API1164-06
Access Control
API1164-07
Remote Access
API1164-09
Patch and Vulnerability Management
API1164-12
Incident Response
API1164-13
Business Continuity and Recovery
API1164-14
Physical Security
API1164-17
Wireless and Field Communications
API1164-18
Field Device Security
API1164-19
Safety Instrumented Systems Interface
API1164-22
Configuration management for OT systems
API1164-23
Change management procedures
API1164-24
Vulnerability assessment for critical systems

How this is calculated

Already covered means a mapping runs from a control in OCC Heightened Standards (12 CFR Part 30, Appendix D) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition