UniFi Network

Administering User Accounts (12.5.4)

Usage Policies (12.3)

Personnel Education (12.6.1)

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

Antivirus software is installed on workstations, laptops, and systems supporting such software.

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-03: Information is correlated from multiple sources

DE.AE-04: The estimated impact and scope of adverse events are understood

DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria

PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

PR.DS-11: Backups of data are created, protected, maintained, and tested

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Protection 1 - Is encryption enabled for confidential, private, and ePHI data as it is accessed within an EHR (in transit)?

ePHI Protection 8 - Are gateway and network devices configured with reasonable settings to protect the network and ePHI data in the network?

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Grants oversight authorities various supervisory rights.

Helps firms prepare compliance frameworks before enforcement; mirrors practices seen in GDPR rollouts.

Establish and Maintain a Secure Configuration Process

Establish and Maintain a Secure Configuration Process for Network Infrastructure