Authelia

Responding to Change-detection Alerts (11.5.1)

Policies and Procedures (11.6)

Restricting Inbound and Outbound Traffic (1.2.1)

Restricting Public Internet Access (1.3)

Documenting Security Policies and Firewall Management (1.5)

Vulnerability Scanning (11.2)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

Alerts are configured to notify operations personnel of capacity issues, enabling timely response to potential system performance or availability risks.

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: Employee training and management?

Do you periodically perform additional risk assessments that re-examine the reasonably foreseeable internal and external risks to customer information that could result in the unauthorized disclosure, or other compromise of such info, and reassess the safeguards in place to control these risks?

Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,

Do you currently base your IS program on a risk assessment that identifies foreseeable internal and external risks to the security, and integrity of customer info that could result in the unauthorized disclosure, or other compromise of such info, and assesses the safeguards to control these risks?

Does this risk assessment include consideration of risks in each relevant area of your operations, including: detecting, preventing and responding to attacks, intrusions, or other systems failures?