Splunk

Anti-virus Capabilities (5.1.1)

Disabling Anti-virus (5.3)

GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

GV.RM-05: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources

ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated

ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established

ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use

Training 5 - Does training include explaining security event reporting - who to contact and what to do in case of suspicious activity?

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Training 1 - Are all workforce members (including managers) given cyber, digital, and/or information security training, at least annually?

Training 2 - Are all workforce members given email phishing training regularly (monthly or quarterly)?

3rd Party Access Controls 1 - Are unique credentials used for 3rd party, partner, contractor, and/or vendor access to systems that connect to the organization's domain?

Business Agreements 4 - Does each BAA give assurance(s) that the partner or vendor will follow best practices and/or compliance to protect ePHI/PCI/PII?

Training 4 - Does training include password security, safeguarding passwords, compromised passwords, and how to create and change passwords.

Training 3 - Are training sessions recorded or logged for each employee or staff member?

Mandates risk controls for ICT third-party services.

Requires exit and transition strategies for continuity.

Centrally Manage Anti-Malware Software

Establish and Maintain a Secure Network Architecture

Centralize Network Authentication, Authorization, and Auditing (AAA)

Perform Application Layer Filtering

Perform Traffic Filtering Between Network Segments

Train Workforce Members to Recognize Social Engineering Attacks

Train Workforce Members on Recognizing and Reporting Security Incidents