Jira Service Management

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-06: Information on adverse events is provided to authorized staff and tools

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

GV.RR-04: Cybersecurity is included in human resources practices

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Equipment Controls 1 - Is there an asset list that contains the computing devices (servers, workstations, laptops, tablets) with identifiers (serial number, MAC address, etc.)?

Facility Access 4 - Are all network devices (servers, power supplies, switches, routers, firewalls, WAPs) located in an area where they cannot be easily damaged by users or environmental factors?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

Regular reports to national regulators.

Adversaries may acquire domains to mimic legitimate services or impersonate organizations.