Guardian Digital

Access to client data requires a unique ID assigned to each user.

Access removal is initiated upon notification from the business or HR of employee termination, role changes, or contract expiration.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Changes - Are physical changes to the facility documented and updated appropriately?

Outlines ICT governance roles for senior management.

Utilize an Active Discovery Tool

Tune Security Event Alerting Thresholds

What measures are in place to protect sensitive employee and customer data from unauthorized access or data breaches? (Data Security and Privacy)

Change-control processes and procedures are followed for all changes to system components.