Devo

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documenting Security Policies and Firewall Management (1.5)

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Requires regular, secure backups and recovery processes.

Ensures fund managers also comply with digital operational resilience obligations.

Monitor Service Providers

Establish and Maintain an Incident Response Process