HubSpot CRM

Verifying User Identities (8.2.2)

User ID Management (8.1.2)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

All system changes, including their review, approval, and evidence of adherence to the Change Management Policy, are documented in Jira to maintain a centralized and auditable record.

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

PR.IR-04: Adequate resource capacity to ensure availability is maintained

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Access Control 2 P & P - Are there both policies and procedures to ensure that idle computing devices enable lock screen after 10 minutes of non-use?

Security event reporting - Are there both policies and procedures that define a security event and provide instruction for communicating the event to appropriate personnel?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Procedures for formally designating critical providers.

Grants oversight authorities various supervisory rights.

Defines the obligations of designated providers.

Outlines how and when designations are reviewed.

Defines ESAs??? supervisory and coordinating roles.

Clarifies ECB involvement in oversight activities.

Cloud service customers must ensure that public-facing domain ownership, registrar controls, and DNS management are governed with documented accountability.