ServiceNow SecOps

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

Securing Cryptographic Key Distribution (3.6.2)

Clear-text Cryptographic Key Management (3.6.6)

User Authentication Management (8.2)

Securing Cryptographic Key Storage (3.6.3)

User ID Management (8.1.2)

Revoking Access for Terminated Users (8.1.3)

Removing/disabling Inactive User Accounts (8.1.4)

Maintain a Description of the Cryptographic Architecture (3.5.1)

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

GV.OC-01: The organizational mission is understood and informs cybersecurity risk management

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving

GV.RR-03: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

GV.RR-04: Cybersecurity is included in human resources practices

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-08: An incident's magnitude is estimated and validated

6.3 Information security awareness, education , and training - Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies, and procedures, as relevant for their job function.

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

7.6 Working in secure areas - Procedures for working in secure areas shall be designed and implemented.

7.9 Security of assets off premises - Off-site assets shall be protected.

8.11 Data Masking - Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Business Agreements 1 - Does the organization have a list of all business associates and vendors with access to ePHI, and is there a Business Agreement in place with each partner, contractor, and vendor that recognizes each party's responsibility for data protection?

Business Agreements 2 - Is there a Business Agreement in place with each partner, contractor, and vendor that ensures disclosure if the 3rd party experiences a cyber attack, data breach, of other security event?

3rd Party Access Controls 3 - Do the organization's Business Agreements clearly identify which vendors, partners, suppliers, 3rd party organizations will or may have access to ePHI, how they will use it, and their commitment to protecting it?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Agreements 3 - Do Business Associate Agreements (BAAs) describe how the businesses will communicate security/network/and interface technology changes and events to one another?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?