Anomali

Protection of Audit Trail Files (10.5.2)

Firewall and Router Configuration Standards (1.1)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Daily Log Reviews (10.6.1)

Date and Time is Logged (10.3.3)

Logging Audit Trails (10.2.3)

Type of Event is Logged (10.3.2)

Limiting DMZ InBound Traffic (1.3.2)

Origination of Event is Logged (10.3.5)

Securing and Synchronizing Router Configuration Files (1.2.2)

User Identification is Logged (10.3.1)

Restricting Traffic Between the Internet and the Cardholder Data Environment (1.3.4)

Success or Failure Indication is Logged (10.3.4)

Implementing Audit Trails (10.1)

Logging User Access to Cardholder Data (10.2.1)

Implementing a DMZ to Limit Inbound Traffic (1.3.1)

Wireless Networks Transmitting Cardholder Data (4.1.1)

Disclosure of Private IPs and Routing Information (1.3.7)

Roles and Responsibilities for Managing Network Components (1.1.5)

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained

ID.AM-04: Inventories of services provided by suppliers are maintained

ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

PR.PS-01: Configuration management practices are established and applied

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

RS.AN-08: An incident's magnitude is estimated and validated

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Sets out coordinated testing protocols with authorities.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Ensures fund managers also comply with digital operational resilience obligations.