VMware vRealize

Firewall and Router Configuration Standards (1.1)

Production Data for Development (6.4.3)

Public-facing Web Applications (6.6)

Securing Cryptographic Key Storage (3.6.3)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

Restricting Access to Cryptographic Keys (3.5.2)

Restricting Inbound and Outbound Traffic (1.2.1)

Installing Critical Security Patches (6.2)

Firewall Network Requirements (1.1.4)

Restricting Public Internet Access (1.3)

Security of Custom Application Accounts (6.3.1)

Documented Change Approval (6.4.5.2)

Documenting Security Policies and Firewall Management (1.5)

Change Control Processes and Procedures (6.4)

Implementing a DMZ to Limit Inbound Traffic (1.3.1)

Current Network Diagram (1.1.2)

Disclosure of Private IPs and Routing Information (1.3.7)

GV.OC-02: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

5.15 Access Control - Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.

5.16 Identity Management - The full lifecycle of identities shall be managed.

5. 24 Information security incident management planning and preparation - The organization shall plan and prepare for managing information security incidents by defining, establishing, and communicating information security incident management processes, roles, and responsibilities.

3rd Party Access Controls 2 - Are there procedures for terminating or changing 3rd party access when the BAA, contract, or relationship ends or changes?

Meeting HIPAA regulations. - The practice (with IT support) reviews the practice's Security Policies and IT Procedures to meet the requirements for HIPAA compliance, at least annually.

Segmentation - Are there mechanisms in place to segment the organization's internal network from any shared network space occupied by vendors and partners?

Remediating Vulnerabilities - In the past 12 months, has the organization implemented remediation steps for identified 'critical' and 'important' vulnerabilities?

Does the monitoring and testing include continuous monitoring or periodic penetration testing and vulnerability assessments?

Do you conduct Annual penetration testing of your information systems, determined each give year based on relevant identified rusisk in accordance with the risk assessment?

Do you Evaluate and adjust your IS program in light of the results of the testing and monitoring including any material changes to your operations or business arrangements or any other circumstances that you know or have reason to know may have a material impact on your IS program?

Do you conduct vulnerability assessments whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program?

Explains proportional application of DORA based on entity type.