Ivanti Neurons

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.PS-01: Configuration management practices are established and applied

PR.PS-04: Log records are generated and made available for continuous monitoring

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Facility Changes - Are physical changes to the facility documented and updated appropriately?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

53

Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.