AgileBlue

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Have you Implemented policies and procedures to ensure that personnel are able to enact your IS program by utilizing qualified IS personnel employed by you or an affiliate or service provider sufficient to manage your IS risks and to perform or oversee the IS program?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by providing information security personnel with security updates and training sufficient to address relevant security risks?

Requires regular, secure backups and recovery processes.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Grants oversight authorities various supervisory rights.

Outlines how and when designations are reviewed.

Designate Personnel to Manage Incident Handling

Define Mechanisms for Communicating During Incident Response