Carbonite Backup for Microsoft 365

Maintaining a List of Service Providers (12.8.1)

Verifying User Identities (8.2.2)

Administering User Accounts (12.5.4)

User ID Management (8.1.2)

Managing Service Providers (12.8)

Personnel Education (12.6.1)

Revoking Access for Terminated Users (8.1.3)

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Entities must maintain a complete incident register.

Facilitates international collaboration on ICT matters.

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

Establish and Maintain an Inventory of Service Providers