PDQ Connect

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Date and Time is Logged (10.3.3)

Logging Audit Trails (10.2.3)

User Identification is Logged (10.3.1)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

Facility Access 1 - Is there a procedure or mechanism to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.) and are staff educated about the process?

Equipment Controls 3 - Are electronic devices which held or accessed ePHI sanitized and disposed of properly at the time of device retirement/decommissioning?

Equipment Controls 1 - Is there an asset list that contains the computing devices (servers, workstations, laptops, tablets) with identifiers (serial number, MAC address, etc.)?

Have you designated an employee or employees to coordinate your information security program?

Have you currently Designated a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program? The Qualified Individual may be employed by you, an affiliate, or a service provider.

Have you designated a senior member of your personnel responsible for direction and oversight of the Qualified Individual?

Have you identified reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized compromise of such information, and assessed the sufficiency of any safeguards in place to control these risks?

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Entities must maintain a complete incident register.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Requires exit and transition strategies for continuity.