Nudge Security

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

Intrusion-detection/intrusion-prevention (11.4)

Minimizing Cardholder Data Storage (3.1)

Document and Implement Key Management Processes and Procedures (3.6)

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

RS.MI-01: Incidents are contained

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

6.8 Information security event reporting - The organization shall provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Steps for handling ICT-related incidents.

Ensure Network Infrastructure is Up-to-Date

Train Workforce Members on Authentication Best Practices