Cisco Webex Calling

Change-control processes and procedures are followed for all changes to system components.

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Type of Event is Logged (10.3.2)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Protections 3 P & P - Are there both Policies and Procedures to ensure that confidential, private, and ePHI data is encrypted throughout the organization's domain?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Requires regular, secure backups and recovery processes.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Grants oversight authorities various supervisory rights.

Outlines how and when designations are reviewed.