Cisco Meraki MS

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Type of Event is Logged (10.3.2)

Success or Failure Indication is Logged (10.3.4)

Logging User Access to Cardholder Data (10.2.1)

Wireless Networks Transmitting Cardholder Data (4.1.1)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?

Do you require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body.

55