Mitel

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

PR.PS-01: Configuration management practices are established and applied

PR.PS-05: Installation and execution of unauthorized software are prevented

8.1 User end point devices - Information stored on, processed by or accessible via user endpoint devices shall be protected.

8.24 Use of cryptography - Rules for the effective use of cryptography, including cryptographic key management, shall be defined, and implemented.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

Steps for handling ICT-related incidents.

Creates an EU-level oversight structure for critical vendors.

Defines the obligations of designated providers.