Five9

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared

RS.MA-04: Incidents are escalated or elevated as needed

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures?

55