Borg Backup

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-02: Incident reports are triaged and validated

RS.MA-05: The criteria for initiating incident recovery are applied

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?

Business Agreements 2 - Is there a Business Agreement in place with each partner, contractor, and vendor that ensures disclosure if the 3rd party experiences a cyber attack, data breach, of other security event?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?