Censornet Web Security

Public-facing Web Applications (6.6)

Improper Error Handling (6.5.5)

Injection Flaws (6.5.1)

Cross-site Scripting (XSS) (6.5.7)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Does your incident response plan address the following areas:The goals of the incident response plan, The internal processes for responding to a security event, The definition of clear roles, responsibilities, and levels of decision-making authority?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

Does your incident response plan address the following areas: External and internal communications and information sharing, and Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.