FortiManager

MFA for remote access (8.3.2)

Maintaining a List of Service Providers (12.8.1)

Verifying User Identities (8.2.2)

List of Authorized Usage of Devices (12.3.3)

User Authentication Management (8.2)

Lockout Duration (8.1.7)

User ID Management (8.1.2)

Session Time Out (8.1.8)

Usage Policies (12.3)

Policies and Procedures for User Identification Management (8.1)

Removing/disabling Inactive User Accounts (8.1.4)

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

PR.PS-05: Installation and execution of unauthorized software are prevented

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Facility Access 4 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be easily damaged by users or environmental factors?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

Amends existing laws to align with DORA.

How does the board monitor the organization's compliance with relevant cybersecurity regulations and standards? (Monitoring compliance with regulations)

How frequently does the board receive updates on the organization's current cyber threat landscape and potential vulnerabilities? (Frequency of threat landscape updates)

How does the organization monitor and ensure compliance with relevant regulations? (Regulatory Compliance Failure)