Cypago

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Use of Strong Cryptography and Security Protocols (4.1)

Least Privilege Access (7.1.2)

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-02: The organization's technology assets are protected from environmental threats

PR.IR-04: Adequate resource capacity to ensure availability is maintained

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Practice Point of Contact - Who is the primary point of contact for the Practice?