Xero Accounting

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Change management policies are established that include procedures for tracking, testing, approving, and communicating changes. Policies are reviewed annually.

All system change requests are formally documented, including a description of the change, justification, and affected systems or components.

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles

PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected

ePHI Protection 9 - Are there mechanisms in place to protect ePHI from unauthorized modification or deletion?

ePHI Access 2 - Does each user with access to ePHI and systems with ePHI access have a unique set of credentials for login?

ePHI Access 1 - Is there a mechanism to both control and log user access to systems that contain ePHI or contain or access an EHR?

Have you designed and implemented information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures?

Do you Design and implement safeguards to Limit authorized users' access only to customer information that they need to perform their duties or, in the case of customers, to access their own information?

Have you developed, implemented, and currently maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates?

Do you regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems?

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Contracts must include specific operational clauses.

Requires exit and transition strategies for continuity.

Establish and Maintain a Data Recovery Process

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Ensure Service Provider Contracts Include Security Requirements

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents