CloudCheckr

Access to client data requires a unique ID assigned to each user.

MFA is enabled on all production servers or in all environments where changes can be promoted.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Requests to remove or disable access for terminated or disabled employees, temporary employees, or consultants are documented in the Jira ticketing system to maintain an auditable record.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-02: The organization's technology assets are protected from environmental threats

RS.CO-02: Internal and external stakeholders are notified of incidents

RS.CO-03: Information is shared with designated internal and external stakeholders

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.2 Information security roles and responsibilities shall be defined and allocated according to the organization needs.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Explains proportional application of DORA based on entity type.

Requires regular, secure backups and recovery processes.

Perform Automated Backups

Establish and Maintain an Isolated Instance of Recovery Data

Test Data Recovery

Conduct Routine Incident Response Exercises

Conduct Post-Incident Reviews

Establish and Maintain Security Incident Thresholds

Change-control processes and procedures are followed for all changes to system components.