Buttercup

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Use of Strong Cryptography and Security Protocols (4.1)

Improper Access Control (6.5.8)

Broken Authentication and Session Management (6.5.10)

Insecure Cryptographic Storage (6.5.3)

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Requires regular, secure backups and recovery processes.

53

Train Workforce on Data Handling Best Practices

Train Workforce Members on Recognizing and Reporting Security Incidents

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization manage the risk of employee turnover and its impact on business operations? (Employee Turnover)

How does the organization ensure that employees are adequately trained and aware of security best practices to mitigate the risk of security incidents? (Security Awareness and Training)