Prisma Cloud

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Production Data for Development (6.4.3)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Broken Authentication and Session Management (6.5.10)

Daily Log Reviews (10.6.1)

Addressing Coding Vulnerabilities (6.5)

Type of Event is Logged (10.3.2)

Firewall Network Requirements (1.1.4)

Restricting Public Internet Access (1.3)

Developing Internal and External Software Applications (6.3)

Documented Change Approval (6.4.5.2)

Success or Failure Indication is Logged (10.3.4)

Change Control Procedures for Security Patches and Software Modifications (6.4.5)

Implementing Audit Trails (10.1)

Documenting Security Policies and Firewall Management (1.5)

Logging User Access to Cardholder Data (10.2.1)

Synchronization of All Critical System Clocks and Times (10.4)

Current Network Diagram (1.1.2)

Disclosure of Private IPs and Routing Information (1.3.7)

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-06: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Events and Incidents 2 - Are the procedures to detect, prevent, and respond to security and IT events documented and available for analysis for a reasonable amount of time?

Defines the scope of digital resilience testing.

54

Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.