BigChange

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.

Job descriptions are defined for all personnel responsible for designing, developing, implementing, operating, monitoring, and maintaining the system. These descriptions outline roles, responsibilities, and required skills to ensure alignment with organizational objectives.

During the recruitment process, candidates are evaluated against defined job requirements to ensure they possess the necessary qualifications, skills, and experience for their roles.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?

Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Practice Point of Contact - Who is the primary point of contact for the Practice?

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you conduct vulnerability assessments including any system scans or reviews of systems resonably designed to identify publicly known security vulnerabilities in your information system based on the risk assessment at lease every six months?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?

Provides definitions of key terms used in the regulation.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Requires exit and transition strategies for continuity.

Establish and Maintain a Data Management Process

Establish and Maintain a Secure Configuration Process

Assess Service Providers

Monitor Service Providers