FileWave

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process

RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Regular reports to national regulators.

Expands the Solvency II framework to address digital resilience in insurance.

Utilize an Active Discovery Tool

Use a Passive Asset Discovery Tool

Utilize Automated Software Inventory Tools

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)