Arctic Wolf Managed Risk

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Events and Incidents 2 - Are the procedures to detect, prevent, and respond to security and IT events documented and available for analysis for a reasonable amount of time?

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Procedures for formally designating critical providers.

Grants oversight authorities various supervisory rights.

Defines the obligations of designated providers.

Outlines how and when designations are reviewed.

Expands the Solvency II framework to address digital resilience in insurance.

Utilize an Active Discovery Tool

Use a Passive Asset Discovery Tool

Utilize Automated Software Inventory Tools

Configure Automatic Anti-Malware Scanning of Removable Media

Tune Security Event Alerting Thresholds