ForgeRock

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Type of Event is Logged (10.3.2)

Policies and Procedures for Protecting Against Malware (5.4)

Assignment of Privileges (7.2.2)

Success or Failure Indication is Logged (10.3.4)

Implementing Audit Trails (10.1)

Defining Access Needs (7.1.1)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Practice Point of Contact - Who is the primary point of contact for the Practice?

Sets out coordinated testing protocols with authorities.