Qualys

Maintaining a List of Service Providers (12.8.1)

Written Acknowledgement of Service Provider Responsibility (12.9)

List of Authorized Usage of Devices (12.3.3)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Incident Response Plan (12.10)

Policy Reviews and Updates (12.1.1)

Managing PCI DSS Requirements by Service Providers (12.8.5)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Installing Critical Security Patches (6.2)

Personnel Education (12.6.1)

Monitoring and Controlling All Access to Data (12.5.5)

Limiting Access to Cardholder Data (7.1)

Security Awareness Program (12.6)

Wireless Networks Transmitting Cardholder Data (4.1.1)

Access Control System Restrictions (7.2)

Compliance Scorecard has an established policy that identifies and designates what information is considered confidential information, and details the information handling, retention and destruction requirements.

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Perform Automated Backups

Establish and Maintain an Isolated Instance of Recovery Data

Conduct Post-Incident Reviews

Establish and Maintain Security Incident Thresholds