CyberCNS

MFA for remote access (8.3.2)

Verifying User Identities (8.2.2)

User Authentication Management (8.2)

Unique User IDs (8.1.1)

Lockout Duration (8.1.7)

MFA for non-console access to CDE (8.3.1)

User ID Management (8.1.2)

Use of Other Authentication Mechanisms (8.6)

Password Requirements (8.2.3)

Policies and Procedures for User Identification Management (8.1)

Removing/disabling Inactive User Accounts (8.1.4)

Access to client data requires a unique ID assigned to each user.

The virtual firewall is equipped with intrusion detection and prevention system capabilities to identify and block malicious network-based activity or abuse of cloud assets.

The virtual firewall is configured to log alerts for suspicious activity, including potential security events or incidents.

Logged alerts are reviewed and investigated as needed to identify, respond to, and mitigate suspicious or malicious activity.

All access request and modification activities are documented in the Jira ticketing system to maintain an auditable record of approvals and provisioning.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

MFA is enabled on all production servers or in all environments where changes can be promoted.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

Requests to remove or disable access for terminated or disabled employees, temporary employees, or consultants are documented in the Jira ticketing system to maintain an auditable record.

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Regular reports to national regulators.

Establish and Maintain Detailed Enterprise Asset Inventory

Establish and Maintain a Software Inventory

Ensure Authorized Software is Currently Supported

Establish and Maintain a Data Inventory

Establish and Maintain a Data Classification Scheme

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

Are regular internal or external cybersecurity audits or assessments conducted, and how are the findings communicated and addressed? (Frequency and follow-up on cybersecurity audits)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)

What measures are in place to assess and manage cybersecurity risks at the organizational level? (Existence and effectiveness of risk assessment measures)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)