Digital Guardian

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

Rules for reporting major ICT-related incidents.

Specifies deadlines and required content for incident reports.