Rapid7 InsightAppSec

Firewall and Router Configuration Standards (1.1)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Restricting Inbound and Outbound Traffic (1.2.1)

Firewall Network Requirements (1.1.4)

Documenting Security Policies and Firewall Management (1.5)

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

Events and Incidents 1 - Does the organization or its IT MSP have procedures documented and implemented to detect, prevent, and respond to security incidents?

Business Continuity Plan 2 - Does the organization have a documented plan to receive, access, maintain, and record PHI in the event of a digital failure, and restore those records electronically after an incident has been recovered from?

Disaster Recovery Plan 1 - Does the organization have a Disaster Recovery Plan that outlines the steps needed to restore critical services and processes for business continuity in the case of a disastrous event?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

Business Continuity Plan 1 - Does the organization have a Business Continuity Plan that identifies business critical services and data sets needed to continue patient/client service?

Disaster Recovery Plan 2 - Is critical data (backed up at least weekly) to a network or cloud repository available for data recovery?

ePHI Protection 7 - Does the organization (or its IT support) regularly evaluate information system configurations for security best practices?

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Does the report include the overall status of the IS program and compliance, and matters related to the program addressing issues such as risk assessment/mgmt and control decisions,service provider arrangements,testing results,security events/violations and mgmt's responses, and recommended changes?

Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?

Do you require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body.

Establish and Maintain a Software Inventory

Ensure Authorized Software is Currently Supported