Splashtop Secure Workspace

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Public-facing Web Applications (6.6)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Daily Log Reviews (10.6.1)

Date and Time is Logged (10.3.3)

Type of Event is Logged (10.3.2)

Installing Critical Security Patches (6.2)

Security of Custom Application Accounts (6.3.1)

User Identification is Logged (10.3.1)

Success or Failure Indication is Logged (10.3.4)

Implementing Audit Trails (10.1)

Logging User Access to Cardholder Data (10.2.1)

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

Employment Screening - Does the organization screen potential employees during the hiring process, to determine trustworthiness?

Roles - CISO - Is there an employee in the organization that oversees the development and implementation of security policies and procedures?

Responsibilities - ePHI - Does the organization have personnel classifications or job descriptions for which staff have access to ePHI?

Responsibilities - Perms - Is/are there personnel responsible for determining and implementing the appropriate access and permissions levels for users?

Responsibilities - CISO - Are the job role and responsibilities of the employee who oversees the development and implementation of security policies and procedures fully documented?

Roles - Authority - If there is not a job role identified for development and implementation of security policies, is there a recognized personnel that staff contact in the case of security events?

Have you Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment?\

Have you Implemented policies and procedures to ensure that personnel are able to enact your IS program by utilizing qualified IS personnel employed by you or an affiliate or service provider sufficient to manage your IS risks and to perform or oversee the IS program?

Have you Implemented policies and procedures to ensure that personnel are able to enact your information security program by providing information security personnel with security updates and training sufficient to address relevant security risks?