Actifile

Changing Vendor-supplied Defaults (2.1)

Removing Unnecessary Functionality (2.2.5)

Developing Configuration Standards for All System Components (2.2)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-06: Information on adverse events is provided to authorized staff and tools

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders

GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

Expands the Solvency II framework to address digital resilience in insurance.

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?

How likely is the HR department to face risks related to improper handling of employee relations issues or ineffective conflict resolution?

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?