Level

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 4 - Do mobile devices that contain or have access to ePHI have encryption enabled?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

ePHI Access 5 - If the organization does not use an EHR, is there a mechanism or procedure in place to control the access of personnel to read, modify, or delete ePHI?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Entities must maintain a complete incident register.

Ensures fund managers also comply with digital operational resilience obligations.

Configure Automatic Anti-Malware Signature Updates

Establish and Maintain a Secure Network Architecture

Centralize Network Authentication, Authorization, and Auditing (AAA)

Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise???s AAA Infrastructure

Manage Access Control for Remote Assets

Train Workforce Members to Recognize Social Engineering Attacks

Train Workforce Members on Recognizing and Reporting Security Incidents

Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.