Salesforce Sales Cloud

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Removing Unnecessary Functionality (2.2.5)

Enabling Only Necessary Services (2.2.2)

Configuring System Security Parameters to Prevent Misuse (2.2.4)

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.OC-05: Outcomes, capabilities, and services that the organization depends on are understood and communicated

PR.IR-01: Networks and environments are protected from unauthorized logical access and usage

PR.IR-02: The organization's technology assets are protected from environmental threats

Conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.