ServiceNow ITSM

Security Policies and Procedures for Managing Vendor Defaults (2.5)

Developing Configuration Standards for All System Components (2.2)

Enabling Only Necessary Services (2.2.2)

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

RS.MI-01: Incidents are contained

RS.MI-02: Incidents are eradicated

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Vendor and Business Associate List - Provide a full and detailed list of the practice's vendors and business associates with: representative contact informationwhether the vendor provides cloud or other servicesscope of the service provided (application, supplies, equipment, etc)systems (

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Practice point of contact information - What is the title or role, the phone number, and the email contact for the point of contact of the practice?

Practice Name, address, and primary phone - Practice name, primary address, and primary phone number.

Information Technology Responsibilities - Is the party responsible for Information Technology (IT) internal to the organization, or a contracted IT support firm (MSP)?

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Practice Point of Contact - Who is the primary point of contact for the Practice?