Veritas Alta SaaS Protection

Policies and Procedures (11.6)

Limiting Access to Cardholder Data (7.1)

Access Control System Restrictions (7.2)

Vulnerability Scanning (11.2)

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

PR.PS-05: Installation and execution of unauthorized software are prevented

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does your incident response plan address the following areas: Documentation and reporting regarding security events and related incident response activities, and the evaluation and revision as necessary of the incident response plan following a security event?

Does your incident response plan address the following areas:The goals of the incident response plan, The internal processes for responding to a security event, The definition of clear roles, responsibilities, and levels of decision-making authority?

Does your incident response plan address the following areas: External and internal communications and information sharing, and Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls?

Sets out coordinated testing protocols with authorities.