AlienVault USM

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Configuring System Security Parameters to Prevent Misuse (2.2.4)

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Audit Reports - Does the organization retain Audit Report records for a minimum of (6) years, consistent with retention requirements for all information security documentation?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

ePHI Access 5 - If the organization does not use an EHR, is there a mechanism or procedure in place to control the access of personnel to read, modify, or delete ePHI?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Sets out coordinated testing protocols with authorities.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Grants oversight authorities various supervisory rights.

Outlines how and when designations are reviewed.