Cisco Email Security

Changing Vendor-supplied Defaults (2.1)

Removing Unnecessary Functionality (2.2.5)

Enabling Only Necessary Services (2.2.2)

Access to client data requires a unique ID assigned to each user.

MFA is enabled on all production servers or in all environments where changes can be promoted.

AWS is configured for security logging, alerting and monitoring for potential threats.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Requests to remove or disable access for terminated or disabled employees, temporary employees, or consultants are documented in the Jira ticketing system to maintain an auditable record.

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Sets out coordinated testing protocols with authorities.

Expands the Solvency II framework to address digital resilience in insurance.

What measures are in place to address the risk of employee misconduct or non-compliance with policies and regulations? (Employee Misconduct)

How does the organization ensure that employees are adequately trained and aware of security best practices to mitigate the risk of security incidents? (Security Awareness and Training)