Cortex XDR

Public-facing Web Applications (6.6)

Injection Flaws (6.5.1)

Security of Custom Application Accounts (6.3.1)

Developing Internal and External Software Applications (6.3)

Documented Change Approval (6.4.5.2)

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

PR.IR-02: The organization's technology assets are protected from environmental threats

PR.IR-04: Adequate resource capacity to ensure availability is maintained

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Access Control 3 P & P - Are there both policies and procedures to ensure that user accounts are unique, not shared amongst users?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Protections 1 P & P - Are there both policies and procedures that ensure that systems are protected with anti-virus/anti-malware programs?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Access Control 5 P & P - Are there both policies and procedures to ensure that users are permitted only those permissions necessary to perform their role (Principle of Least Privilege)?

Access Control 6 P & P - Are there both policies and procedures to ensure that idle account access to EHR portals and systems lock-out (require credentials to log back in)?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Access Control 4 P & P - Are there both policies and procedures to ensure that administrative rights are not allocated inappropriately?

Protections 2 P & P - Are there both policies and procedures that ensure that systems receive regular (at least monthly) updates and patches to minimize vulnerabilities?

Requires regular, secure backups and recovery processes.