Confluence

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.4 Disciplinary process - A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

6.5 Responsibilities after termination or change of employment - Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced, and communicated to relevant personnel and other interested parties.

6.7 Remote Working - Security measures shall be implemented when personnel are working remotely to protect information accessed, processed, or stored outside the organization's premises.

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Establish and Maintain a Data Management Process

Establish and Maintain Architecture Diagram(s)

Ensure Service Provider Contracts Include Security Requirements

Establish and Maintain an Incident Response Process

Adversaries may acquire domains to mimic legitimate services or impersonate organizations.