Azure Virtual Desktop

PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Have you designated an employee or employees to coordinate your information security program?

Have you currently Designated a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program? The Qualified Individual may be employed by you, an affiliate, or a service provider.

Have you designated a senior member of your personnel responsible for direction and oversight of the Qualified Individual?

Have you identified reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized compromise of such information, and assessed the sufficiency of any safeguards in place to control these risks?

Steps for handling ICT-related incidents.

Criteria for categorizing incidents by severity.

Defines the scope of digital resilience testing.

Ensures fund managers also comply with digital operational resilience obligations.

Establish and Maintain a Secure Configuration Process for Network Infrastructure

Establish and Maintain a Data Recovery Process

Establish and Maintain Architecture Diagram(s)

Establish and Maintain a Service Provider Management Policy

Assess Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process