Jolera

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Enabling Only Necessary Services (2.2.2)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

7.2 Physical entry - Secure areas shall be protected by appropriate entry controls and access points.

7.7 Clear desk and clear screen - Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Mandates risk controls for ICT third-party services.

Brings IORPs (occupational pension funds) under the scope of ICT risk regulation.

Configure Automatic Anti-Malware Signature Updates

Establish and Maintain a Secure Network Architecture

Perform Application Layer Filtering