Celerium

Firewall and Router Configuration Standards (1.1)

Production Data for Development (6.4.3)

Public-facing Web Applications (6.6)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Restricting Inbound and Outbound Traffic (1.2.1)

Broken Authentication and Session Management (6.5.10)

Improper Error Handling (6.5.5)

Firewall Network Requirements (1.1.4)

Restricting Public Internet Access (1.3)

Developing Internal and External Software Applications (6.3)

Formal Firewall and Router Configurations Process (1.1.1)

Documented Change Approval (6.4.5.2)

Restricting Traffic Between the Internet and the Cardholder Data Environment (1.3.4)

Documenting Security Policies and Firewall Management (1.5)

Change Control Processes and Procedures (6.4)

Current Network Diagram (1.1.2)

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

Antivirus software is installed on workstations, laptops, and systems supporting such software.

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.7 Remote Working - Security measures shall be implemented when personnel are working remotely to protect information accessed, processed, or stored outside the organization's premises.

6.8 Information security event reporting - The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 5 - Does user training include specific training about the appropriate handling of ePHI?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Facilitates international collaboration on ICT matters.

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

Are regular internal or external cybersecurity audits or assessments conducted, and how are the findings communicated and addressed? (Frequency and follow-up on cybersecurity audits)

How frequently are the organization's cybersecurity policies, procedures, and controls reviewed and updated? (Frequency of policy and control updates)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)

What measures are in place to assess and manage cybersecurity risks at the organizational level? (Existence and effectiveness of risk assessment measures)

How does the organization ensure that employees receive adequate training on cybersecurity risks and best practices? (Employee training on cybersecurity)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)