Asterisk

Verifying User Identities (8.2.2)

Unique User IDs (8.1.1)

MFA for non-console access to CDE (8.3.1)

Policies and Procedures for User Identification Management (8.1)

Removing/disabling Inactive User Accounts (8.1.4)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

Alerts are configured to notify operations personnel of capacity issues, enabling timely response to potential system performance or availability risks.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-04: Cybersecurity is included in human resources practices

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Equipment Controls 1 - Is there an asset list that contains the computing devices (servers, workstations, laptops, tablets) with identifiers (serial number, MAC address, etc.)?

Facility Access 4 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be easily damaged by users or environmental factors?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

Expands the Solvency II framework to address digital resilience in insurance.