BackupPC

Minimizing Cardholder Data Storage (3.1)

Security Policies and Operational Procedures (3.7)

Managing PAN Data Storage (3.4)

ID.IM-01: Improvements are identified from evaluations

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Steps for handling ICT-related incidents.

Criteria for categorizing incidents by severity.