ClickSoftware

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.16 Identity Management - The full lifecycle of identities shall be managed.

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5.19 Information Security in Supplier relationships - Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of suppliers' products or services.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.12 Data leakage prevention - Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store, or transmit sensitive information.

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?

Business Agreements 2 - Is there a Business Agreement in place with each partner, contractor, and vendor that ensures disclosure if the 3rd party experiences a cyber attack, data breach, of other security event?

3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Agreements 3 - Do Business Associate Agreements (BAAs) describe how the businesses will communicate security/network/and interface technology changes and events to one another?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

Requires regular, secure backups and recovery processes.

Entities must maintain a complete incident register.