RiskRecon

Firewall and Router Configuration Standards (1.1)

Documenting Security Policies and Firewall Management (1.5)

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?

Business Agreements 3 - Do Business Associate Agreements (BAAs) describe how the businesses will communicate security/network/and interface technology changes and events to one another?

Allows voluntary reports of cyber threats.

Authorize, design, develop, implement, operate, approve, and document changes to infrastructure, data, software, and procedures.