CyberQP

Protection of Audit Trail Files (10.5.2)

Scanning Due to Significant Change (11.2.3)

Responding to Change-detection Alerts (11.5.1)

Intrusion-detection/intrusion-prevention (11.4)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Correcting Exploitable Vulnerabilities (11.3.3)

Policies and Procedures (11.6)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

File-integrity Monitoring On Logs (10.5.5)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Daily Log Reviews (10.6.1)

Date and Time is Logged (10.3.3)

Type of Event is Logged (10.3.2)

Policies and Procedures (10.9)

Audit Trails Are Secured (10.5)

External Vulnerability Scanning (11.2.2)

Origination of Event is Logged (10.3.5)

Viewing of Audit Trails (10.5.1)

User Identification is Logged (10.3.1)

Success or Failure Indication is Logged (10.3.4)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

Implementing Audit Trails (10.1)

Logging User Access to Cardholder Data (10.2.1)

Audit Trail Files Back-up (10.5.3)

Vulnerability Scanning (11.2)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-02: Incident reports are triaged and validated

RS.MA-03: Incidents are categorized and prioritized

RS.MA-04: Incidents are escalated or elevated as needed

RS.MA-05: The criteria for initiating incident recovery are applied

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Requires regular, secure backups and recovery processes.

Sets out coordinated testing protocols with authorities.

Establish and Maintain a Service Provider Management Policy

Assess Service Providers

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents