FixMe.IT

Changing Vendor-supplied Defaults (2.1)

ID.AM-01: Inventories of hardware managed by the organization are maintained

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

Steps for handling ICT-related incidents.

Allows voluntary reports of cyber threats.

Brings IORPs (occupational pension funds) under the scope of ICT risk regulation.

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)