ClipTraining

Least Privilege Access (7.1.2)

Policies & Procedures (7.3)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Events and Incidents 2 - Are the procedures to detect, prevent, and respond to security and IT events documented and available for analysis for a reasonable amount of time?

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Entities must maintain a complete incident register.