BVoIP

Maintaining a List of Service Providers (12.8.1)

List of Authorized Usage of Devices (12.3.3)

Public-facing Web Applications (6.6)

Incident Response Plan (12.10)

Usage Policies (12.3)

Acceptable Uses of Technology (12.3.5)

Installing Critical Security Patches (6.2)

Personnel Education (12.6.1)

Security of Custom Application Accounts (6.3.1)

Developing Internal and External Software Applications (6.3)

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?

Business Agreements 2 - Is there a Business Agreement in place with each partner, contractor, and vendor that ensures disclosure if the 3rd party experiences a cyber attack, data breach, of other security event?

3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?

Business Agreements 3 - Do Business Associate Agreements (BAAs) describe how the businesses will communicate security/network/and interface technology changes and events to one another?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

Focus on learning from incidents to improve resilience.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Requires exit and transition strategies for continuity.