§164.310(a)(1): Implement policies and procedures to limit physical access to [...]

§164.308(b)(3): Document the satisfactory assurances required by paragraph (b)(1) or [...]

§164.308(b)(1): A covered entity may permit a business associate to [...]

§164.308(a)(8): Perform a periodic technical and nontechnical evaluation, based initially [...]

§164.308(a)(7)(ii)(E): Assess the relative criticality of specific applications and data [...]

§164.308(a)(7)(ii)(D): Implement procedures for periodic testing and revision of contingency [...]

§164.308(a)(7)(ii)(C): Establish (and implement as needed) procedures to enable continuation [...]

§164.308(a)(7)(ii)(B): Establish (and implement as needed) procedures to restore any [...]

§164.308(a)(7)(ii)(A): Establish and implement procedures to create and maintain retrievable [...]