AvePoint

Scanning Due to Significant Change (11.2.3)

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Responding to Change-detection Alerts (11.5.1)

Changing Vendor-supplied Defaults (2.1)

External Vulnerability Scanning (11.2.2)

Enabling Only Necessary Services (2.2.2)

Vulnerability Scanning (11.2)

Access to client data requires a unique ID assigned to each user.

Access removal is initiated upon notification from the business or HR of employee termination, role changes, or contract expiration.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Inventory Maintenance 2 - In the past 6 months, has the organization maintained a current software asset list?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

How likely is the HR department to experience a significant data breach or unauthorized access to employee data?

How likely is the HR department to face risks related to improper handling of employee relations issues or ineffective conflict resolution?

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?