Keenondots

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.16 Identity Management - The full lifecycle of identities shall be managed.

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Do you currently Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy?

Do you design and implement safeguards to control the risks you identity through risk assessment, including by Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to both?

Defines the scope of digital resilience testing.

Utilize an Active Discovery Tool

Deploy and Maintain Anti-Malware Software

Tune Security Event Alerting Thresholds