Panorays

Responding to Change-detection Alerts (11.5.1)

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Address Unauthorized Assets

Define Mechanisms for Communicating During Incident Response

How likely is the HR department to face operational disruptions due to HR system failures or inadequate HR technology infrastructure

How likely is the HR department to face compliance risks associated with evolving labor laws and regulations?