Adlumin Security Operations Platform

Change-control processes and procedures are followed for all changes to system components.

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

Verifying User Identities (8.2.2)

Securing Cryptographic Key Distribution (3.6.2)

Clear-text Cryptographic Key Management (3.6.6)

Unique User IDs (8.1.1)

Securing Cryptographic Key Storage (3.6.3)

Lockout Duration (8.1.7)

User ID Management (8.1.2)

Restricting PAN (3.3)

Policies and Procedures for User Identification Management (8.1)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.

Information exchange between competent authorities.