Glip

Formal organizational structures, including governance frameworks and reporting lines, are established and documented to ensure clear accountability and operational efficiency.

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.22 Segregation of networks - Groups of information services, users, and information systems shall be segregated in the organization's networks.

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Outlines ICT governance roles for senior management.

Mandates risk controls for ICT third-party services.

Cloud service customers must ensure that public-facing domain ownership, registrar controls, and DNS management are governed with documented accountability.