Rapid7 InsightConnect

Securing Cryptographic Key Distribution (3.6.2)

Storing of Card Verification Codes (3.2.2)

Minimizing Cardholder Data Storage (3.1)

Protecting Keys Used in Storing Cardholder Data (3.5)

ID.IM-01: Improvements are identified from evaluations

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization

PR.AA-03: Users, services, and hardware are authenticated

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed

RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration

RC.RP-05: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

Access Control 7 P & P - Is there a policy to control the access of staff, vendors, and 3rd party personnel to critical equipment (network devices, servers, etc.)?

Passwords P & P - Is there a password policy to ensure that minimum HIPAA password compliance is met?

Protections 4 P & P - Are there processes in place to ensure that members of the public and staff without authorization cannot see ePHI (on computer screens, printers, desktops, etc)?

Access Control 1 P & P - Are there both an Access Control policy and procedure to manage the authenticated and authorized access of people and systems to internal org resources?

Sanctions - Does the organization have sanctioning in its policies to help enforce security procedures?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Have you Implemented policies and procedures to ensure that personnel are able to enact your IS program by utilizing qualified IS personnel employed by you or an affiliate or service provider sufficient to manage your IS risks and to perform or oversee the IS program?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by providing information security personnel with security updates and training sufficient to address relevant security risks?

Specifies the elements of a comprehensive ICT risk framework.

Criteria for categorizing incidents by severity.

Mandates risk controls for ICT third-party services.

Entities must monitor provider performance regularly.