Galvanize

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

ID.IM-01: Improvements are identified from evaluations

PR.PS-01: Configuration management practices are established and applied

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Creates an EU-level oversight structure for critical vendors.

Procedures for formally designating critical providers.

Brings IORPs (occupational pension funds) under the scope of ICT risk regulation.