Druva

Verifying User Identities (8.2.2)

Unique User IDs (8.1.1)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

Access to client data requires a unique ID assigned to each user.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

MFA is enabled on all production servers or in all environments where changes can be promoted.

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Does your incident response plan address the following areas:The goals of the incident response plan, The internal processes for responding to a security event, The definition of clear roles, responsibilities, and levels of decision-making authority?

Does your incident response plan address the following areas: External and internal communications and information sharing, and Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls?

Entities must maintain a complete incident register.