Crewhu

Verifying User Identities (8.2.2)

Unique User IDs (8.1.1)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

Access to client data requires a unique ID assigned to each user.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?

Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Practice Point of Contact - Who is the primary point of contact for the Practice?

Helps firms prepare compliance frameworks before enforcement; mirrors practices seen in GDPR rollouts.