F-Secure Elements

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Wireless Networks Transmitting Cardholder Data (4.1.1)

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.22 Segregation of networks - Groups of information services, users, and information systems shall be segregated in the organization's networks.

8.24 Use of cryptography - Rules for the effective use of cryptography, including cryptographic key management, shall be defined, and implemented.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Do you oversee service providers by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Do you currently Oversee service providers, by: Requiring your service providers by contract to implement and maintain such safeguards?

Do you oversee service providers by requiring your service providers by contract to implement and maintain such safeguards?

If this is a service provider or affiliate, do you require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements?

Do you currently Oversee service providers, by: Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue?

Regular reports to national regulators.

Utilize Automated Software Inventory Tools

Configure Automatic Anti-Malware Scanning of Removable Media