Nerdio

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

User Identification is Logged (10.3.1)

Implementing Audit Trails (10.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

Defined roles and responsibilities are established within the organization, including specific assignments for critical functions, and are documented to ensure clarity of accountability.

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

RS.MA-02: Incident reports are triaged and validated

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Defines ESAs??? supervisory and coordinating roles.