Morpheus

MFA for remote access (8.3.2)

User Authentication Management (8.2)

MFA for non-console access to CDE (8.3.1)

User ID Management (8.1.2)

Password Requirements (8.2.3)

Incorporating Multi-factor Authentication (8.3)

Revoking Access for Terminated Users (8.1.3)

GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

Facility Access 6 - Is there a mechanism(s) in place to restrict physical access to electronic devices, including mobile devices that contain or can access ePHI?

Equipment Changes - Are network changes and equipment changes documented and updated appropriately?

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Expands the Solvency II framework to address digital resilience in insurance.

Address Unauthorized Assets

Define Mechanisms for Communicating During Incident Response