Continuum

Changing Vendor-supplied Defaults (2.1)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Provides definitions of key terms used in the regulation.

Requires alignment of resilience strategy with business strategy.

Requires regular, secure backups and recovery processes.

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Assess Service Providers

Monitor Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process

What measures are in place to protect and manage the risk of data breaches or unauthorized access to sales-related information? (Sales Data Security)

What measures are in place to mitigate the risk of losing key clients or accounts? (Client Loss)