Freshdesk

Changing Vendor-supplied Defaults (2.1)

Removing Unnecessary Functionality (2.2.5)

Enabling Only Necessary Services (2.2.2)

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-04: Inventories of services provided by suppliers are maintained

Training 6 - Is there ongoing training or communication regarding security awareness and requirements for all staff?

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Have you Evaluated and adjusted your information security program in light of the results of the testing and monitoring required, or any material changes to your operations or business arrangements due to the results of risk assessments performed?

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process