Notion

Changing Vendor-supplied Defaults (2.1)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

Job descriptions are defined for all personnel responsible for designing, developing, implementing, operating, monitoring, and maintaining the system. These descriptions outline roles, responsibilities, and required skills to ensure alignment with organizational objectives.

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Train Workforce Members to Recognize Social Engineering Attacks

Train Workforce Members on Authentication Best Practices

Train Workforce on Data Handling Best Practices

Train Workforce Members on Causes of Unintentional Data Exposure

Train Workforce Members on Recognizing and Reporting Security Incidents

Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates

Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks

Periodically assess the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.