Auvik

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

Antivirus software is installed on workstations, laptops, and systems supporting such software.

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-04: Inventories of services provided by suppliers are maintained

ID.AM-05: Assets are prioritized based on classification, criticality, resources, and impact on the mission

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.

5.23 Information security for use of cloud services - Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Amends existing laws to align with DORA.

Centralize Network Authentication, Authorization, and Auditing (AAA)

Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise???s AAA Infrastructure

Perform Application Layer Filtering

Perform Traffic Filtering Between Network Segments

Manage Access Control for Remote Assets