AssetSonar

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk

PR.PS-05: Installation and execution of unauthorized software are prevented

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.12 Data leakage prevention - Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store, or transmit sensitive information.

8.13 Information backup - Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup.

Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Do you periodically perform additional risk assessments that re-examine the reasonably foreseeable internal and external risks to customer information that could result in the unauthorized disclosure, or other compromise of such info, and reassess the safeguards in place to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Information systems, including network and software design, as well as information processing, storage, transmission and disposal?

Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?

Defines grace periods and compliance transition steps.

Change-control processes and procedures are followed for all changes to system components.