VMware Horizon

Verifying User Identities (8.2.2)

Security Policies and Procedures for Managing Vendor Defaults (2.5)

User Authentication Management (8.2)

Lockout Duration (8.1.7)

MFA for non-console access to CDE (8.3.1)

Use of Other Authentication Mechanisms (8.6)

Removing Unnecessary Functionality (2.2.5)

Revoking Access for Terminated Users (8.1.3)

Enabling Only Necessary Services (2.2.2)

Access Control System Restrictions (7.2)

Configuring System Security Parameters to Prevent Misuse (2.2.4)

Default deny-all Setting (7.2.3)

Removing/disabling Inactive User Accounts (8.1.4)

Defining Access Needs (7.1.1)

Monitoring and alerts are configured by the security team to identify and notify management of incidents when thresholds are crossed on security and operational metrics. Issues, if any, are routed through incident management for resolution.

Processing capacity is monitored monthly by management to ensure that current system performance meets operational requirements.

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

DE.CM-01: Networks and network services are monitored to find potentially adverse events

DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events

DE.CM-06: External service provider activities and services are monitored to find potentially adverse events

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Identifying Vulnerabilities - In the past 12 months, has the practice performed (or caused to be performed) recommended tests to identify vulnerabilities?

Inventory Maintenance 1 - In the past 6 months, has the organization maintained a current asset (computing devices) list?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Defines the scope of digital resilience testing.

Details tools for vulnerability and performance testing.

Expands the Solvency II framework to address digital resilience in insurance.