Mosyle Fuse

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

5.1 Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to, and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur

5.18 Access Rights - Access rights to information and other associated assets shall be provisioned, reviewed, modified, and removed in accordance with the organization's topic-specific policy on and rules for access control.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

5.29 Information security during disruption - The organization shall plan how to maintain information security at an appropriate level during disruption.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

ePHI Access 7 - Is there a procedure to ensure access to ePHI is severed and documented when employment or vendor relationship is terminated?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

ePHI Access 4 - Is there a mechanism for alerting a support team if there are issues with login or changes to user accounts controlled by Active Directory?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Brings market infrastructures under DORA???s incident management and ICT governance frameworks.

Expands the Solvency II framework to address digital resilience in insurance.

Establish and Maintain a Data Recovery Process

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents