Darktrace

Broken Authentication and Session Management (6.5.10)

Addressing Coding Vulnerabilities (6.5)

Developing Internal and External Software Applications (6.3)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-06: Information on adverse events is provided to authorized staff and tools

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.21 Security of network services - Security mechanisms, service levels, and service requirements of network services shall be identified, implemented, and monitored.

8.22 Segregation of networks - Groups of information services, users, and information systems shall be segregated in the organization's networks.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.