Freshsales

Administering User Accounts (12.5.4)

Usage Policies (12.3)

Personnel Education (12.6.1)

A business impact analysis (BIA) is performed annually that includes tabletop testing of the business continuity and disaster recovery plans.

On an annual basis, each in-scope system will be restored from a backup and validated to test the integrity of the backup and restore process.

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Defines requirements for detecting ICT anomalies.