NEC

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Production Data for Development (6.4.3)

Broken Authentication and Session Management (6.5.10)

Anti-virus Capabilities (5.1.1)

Type of Event is Logged (10.3.2)

Installing Critical Security Patches (6.2)

Least Privilege Access (7.1.2)

Record Audit Trail Entries For All System Components (10.3)

Developing Internal and External Software Applications (6.3)

Origination of Event is Logged (10.3.5)

Success or Failure Indication is Logged (10.3.4)

Change Control Processes and Procedures (6.4)

Logging User Access to Cardholder Data (10.2.1)

Facility Entry Controls (9.1)

Audit Trail Files Back-up (10.5.3)

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Inventory Maintenance 2 - In the past 6 months, has the organization maintained a current software asset list?

Mandates risk controls for ICT third-party services.

Describes conditions for sub-outsourcing ICT services.

Establish and Maintain Detailed Enterprise Asset Inventory

Ensure Authorized Software is Currently Supported

Perform Automated Backups

Conduct Post-Incident Reviews