Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company conducts background screenings for all new hires.

The board of directors meets at least once a year and keeps formal minutes of its meetings. It includes members who are independent of the company.

The board of directors has a formal charter that defines its oversight responsibilities related to internal controls.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The board possesses the necessary expertise to oversee management’s design, implementation, and operation of information security controls, and consults external security experts when needed.

The company mandates that contractor agreements either include a code of conduct or refer to the company’s own code of conduct.

Managers are required to conduct performance evaluations for their direct reports at least once a year.

Employees are required to acknowledge the code of conduct upon hiring. Any violations may result in disciplinary action as outlined in the company’s disciplinary policy.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company notifies authorized internal users of system changes.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company informs customers of critical system changes that could impact their processing.

The company defines its objectives to support the identification and assessment of risks associated with achieving them.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company performs the risk assessment process at least annually and whenever significant changes occur in the environment, such as acquisitions, mergers, or relocations.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

The company uses firewalls configured to block unauthorized access.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company reviews data center access at least once a year.

The company’s network is segmented to block unauthorized access to customer data.

The company encrypts datastores containing sensitive customer data at rest.

The company has implemented procedures to guard against, detect, and report malicious software.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

The company restricts remote access to production systems to authorized employees using an approved encrypted connection.

The company installs critical security patches within one month of their release, as determined by the risk ranking process defined in VPM-4.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

System access shall be restricted to authorized individuals.

The company uses secure transmission protocols to encrypt confidential and sensitive data when it is transmitted over public networks.

Authority checks shall restrict system use, electronic signing, access to operations or system input/output devices, record alteration, and performance of the operation at hand to authorized individuals.

The company limits privileged access to the firewall to authorized users who have a valid business need.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company’s security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management in accordance with its security incident response policy and procedures.

The company uses a log management tool to detect events that could potentially affect its ability to meet security objectives.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company tests its incident response plan at least once a year.

The company maintains a process for identifying security vulnerabilities that includes: 1. Using reputable external sources to obtain current vulnerability information 2. Assigning risk rankings to identified vulnerabilities, clearly highlighting all high-risk and critical issues Risk rankings follow industry best practices and consider factors such as CVSS base scores, vendor classifications, and the affected system types. The risk assessment strategy ensures that all high-risk vulnerabilities are identified and that critical vulnerabilities, including those impacting public-facing systems, security infrastructure, or systems processing cardholder data, are addressed promptly.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

System documentation shall be subject to revision and change control procedures that maintain an audit trail documenting time-sequenced development and modifications.

The company restricts production change migrations to authorized personnel only.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

The company tests its incident response plan at least once a year.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

The company encrypts datastores containing sensitive customer data at rest.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company’s system evaluates data inputs for compliance with input requirements and generates on-screen alerts when issues with transaction inputs or processing are detected.

Operational system checks shall be used, as appropriate, to enforce permitted sequencing of steps and events.

A controller shall provide consumers with an appropriately accessible, clear, and meaningful privacy notice that includes: 1. The categories of personal data processed by the controller 2. The purpose for processing personal data 3. The methods by which consumers may exercise their rights, including how a consumer may appeal a controller’s decision 4. The categories of personal data, if any, that the controller shares with third parties 5. The categories of third parties, if any, with which the controller shares personal data, and 6. An active electronic mail address or other online mechanism that consumers may use to contact the controller

To establish efficient governance for PII processing.

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The organization identifies and documents the specific purposes for which personally identifiable information is processed.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes a mechanism that enables individuals to modify or withdraw their consent for the processing of their personally identifiable information.

A controller shall limit the collection of personal data to what is necessary for the intended purpose. Personal data shall be obtained only through lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

The company shall, at or before the point of collection, inform the consumer if sensitive personal information will be collected. The company shall disclose the categories of sensitive personal information collected, the purposes for which the categories are collected or used, and whether the information is sold or shared.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

A controller or processor shall restrict the creation, use, processing, storage, maintenance, dissemination, or disclosure of personal information to what is directly necessary for a defined business objective. Personal information shall be retained only for as long as required to achieve that objective and shall be securely deleted once it is no longer needed.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

Personal data shall not be disclosed, made available, or otherwise used for purposes other than those specified, except: a) With the consent of the data subject, or b) By the authority of law

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

The purposes for which personal data is collected shall be specified no later than at the time of collection. Subsequent use of the data shall be limited to fulfilling those purposes or to purposes that are compatible and specified whenever a change of purpose occurs.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The organization provides customers with mechanisms or support necessary to enable them to meet obligations owed to individuals regarding the processing of personally identifiable information.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

Secure, computer-generated, time-stamped audit trails shall independently capture the date and time of operator entries and actions that create, modify, or delete electronic records, and shall preserve prior information so changes do not obscure earlier entries. Audit trail documentation shall be retained for at least the same period as the associated electronic records and shall be available for FDA review and copying.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

The company informs customers of critical system changes that could impact their processing.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

A controller or processor shall restrict the creation, use, processing, storage, maintenance, dissemination, or disclosure of personal information to what is directly necessary for a defined business objective. Personal information shall be retained only for as long as required to achieve that objective and shall be securely deleted once it is no longer needed.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

Because of their effect or potential effect on the organization’s ability to consistently deliver products and services that meet customer and applicable statutory and regulatory requirements, the organization shall determine: 1. The interested parties relevant to the quality management system 2. The requirements of these interested parties relevant to the quality management system The organization shall monitor and review information about these interested parties and their requirements.

The organization shall define the boundaries and applicability of the quality management system to establish its scope. In doing so, it shall consider: 1. External and internal issues identified in CPL-77 2. Requirements of relevant interested parties identified in AST-109 3. The organization’s products and services All applicable requirements of this International Standard shall be included within the defined scope. The scope shall be documented, maintained, and available. It shall state the products and services covered and justify any requirements deemed not applicable. Conformity may only be claimed if exclusions do not affect the organization’s ability or responsibility to ensure product and service conformity or to enhance customer satisfaction.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

Responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally defined in job descriptions and/or the Information Security Roles and Responsibilities policy.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company reviews the security policy at least annually and updates it whenever there are changes to the environment.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company maintains a documented risk management program that provides guidance on identifying potential threats, assessing the significance of associated risks, and implementing mitigation strategies.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company conducts periodic technical and nontechnical evaluations, initially based on the HIPAA Security Rule, and subsequently in response to environmental or operational changes affecting the security of electronic Protected Health Information (ePHI), to determine whether its security policies and procedures continue to meet the requirements of the HIPAA Security Rule (Subpart C).

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

Where a product incorporates an AI system and is subject both to the requirements of this Regulation and to the requirements of applicable Union harmonisation legislation, the provider shall be responsible for ensuring that the product complies in full with all applicable requirements under that Union harmonisation legislation. When ensuring that high-risk AI systems comply with the requirements set out in this Section, providers may, for the purpose of ensuring consistency, avoiding duplication, and minimising additional burdens, choose to integrate the relevant testing and reporting activities, as well as the information and documentation relating to the AI system, into existing documentation and procedures required under the applicable Union harmonisation legislation.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

When a nonconformity is identified, the organization: 1. Responds to the issue by: a) Taking action to control and correct it b) Addressing any resulting consequences 2. Assesses the need for action to prevent recurrence or occurrence elsewhere by: a) Reviewing the nonconformity b) Identifying its root causes c) Determining whether similar issues exist or could potentially arise 3. Implements necessary corrective actions 4. Evaluates the effectiveness of those actions 5. Updates the information security management system as needed Corrective actions are proportionate to the impact of the nonconformities. Documented information is retained to demonstrate: 1. The nature of the nonconformities and the actions taken 2. The results of any corrective actions

Responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally defined in job descriptions and/or the Information Security Roles and Responsibilities policy.

Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company performs risk assessments at least annually. This process includes identifying threats and changes (environmental, regulatory, and technological) that may affect service commitments, formally assessing the related risks, and considering how potential fraud could impact the achievement of objectives.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company maintains a formal inventory of assets within the production environment.

The company requires authentication to production datastores to use authorized secure methods, such as unique SSH keys.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

System access is restricted to authorized users only.

The company limits privileged access to the operating system to authorized users with a valid business need.

The company ensures that access to in-scope system components is based on job role and function or requires a documented access request and manager approval before access is granted.

The company uses termination checklists to ensure access for terminated employees is revoked within defined SLAs.

The company ensures electronic media containing confidential information is purged or destroyed following best practices, with certificates of destruction issued for each device.

The company uses firewalls configured to block unauthorized access.

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company tests its incident response plan at least once a year.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The company logs, tracks, and maintains records of personal information disclosed for legal purposes in its designated tracking system for historical reference and audit purposes.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

The company enforces appropriate sanctions against workforce members who fail to comply with its security policies and procedures.

The company identifies and responds to suspected or known security incidents, mitigates harmful effects to the extent practicable, and documents the incidents along with their outcomes.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has established procedures, to be implemented when needed, that allow facility access during emergencies in order to support data restoration as outlined in the disaster recovery and emergency mode operations plans.

The company ensures that data collection and processing are limited to what is required to fulfill the purposes explicitly defined in its documented data processing activities, supporting compliance with data minimization requirements.

The company retains personally identifiable information (PII) only for the duration necessary to fulfill the purposes for which it was collected, in alignment with applicable data retention policies.

The company enters into a written agreement with each processor of personally identifiable information (PII), defining the processor’s responsibilities and required compliance with applicable data protection standards.

The company establishes documented policies and procedures for responding to data breaches, which include defined notification processes to ensure timely communication to relevant stakeholders.

The organization manages identities throughout their entire lifecycle, from creation and use to modification and deactivation.

The organization defines and implements processes and procedures to manage information security risks within the ICT products and services supply chain.

The organization establishes processes for the acquisition, use, management, and exit of cloud services in alignment with its information security requirements.

ICT readiness is planned, implemented, maintained, and tested in alignment with business continuity objectives and ICT continuity requirements.

The organization implements appropriate procedures to safeguard intellectual property rights.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

For public-facing web applications, the company addresses new threats and vulnerabilities on an ongoing basis and protects these applications against known attacks by implementing one of the following methods: 1. Conducting manual or automated application vulnerability assessments that: a) Occur at least annually and after any changes b) Are performed by organizations specializing in application security c) Include all vulnerabilities d) Ensure that all identified vulnerabilities are corrected e) Include re-evaluation of the application following remediation 2. Deploying an automated technical solution, such as a web application firewall, that: a) Is positioned in front of public-facing web applications to detect and prevent attacks b) Is actively running and kept up to date c) Generates audit logs d) Is configured to either block detected web-based attacks or generate alerts that are promptly investigated

The company reviews the security policy at least annually and updates it whenever there are changes to the environment.

The organization shall limit system access exclusively to authorized users, processes operating on behalf of authorized users, and approved devices, including interconnected systems.

The organization shall identify system users, processes operating on behalf of users, and devices.

The organization shall gather and evaluate threat intelligence to identify emerging risks and strengthen its defensive posture. Threat intelligence practices shall be maintained as documented information and assessed regularly to verify their effectiveness.

A managed program and process shall be developed and maintained for business continuity throughout the organization that addresses the information security requirements needed for the organization's business continuity.

Where a product incorporates an AI system and is subject both to the requirements of this Regulation and to the requirements of applicable Union harmonisation legislation, the provider shall be responsible for ensuring that the product complies in full with all applicable requirements under that Union harmonisation legislation. When ensuring that high-risk AI systems comply with the requirements set out in this Section, providers may, for the purpose of ensuring consistency, avoiding duplication, and minimising additional burdens, choose to integrate the relevant testing and reporting activities, as well as the information and documentation relating to the AI system, into existing documentation and procedures required under the applicable Union harmonisation legislation.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.

The company conducts background screenings for all new hires.

Contractors are required to sign a confidentiality agreement when their engagement begins.

Employees are required to sign a confidentiality agreement as part of the onboarding process.

Responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally defined in job descriptions and/or the Information Security Roles and Responsibilities policy.

Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has documented security and privacy incident response policies and procedures, which are communicated to authorized users.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company uses termination checklists to ensure access for terminated employees is revoked within defined SLAs.

The company uses a mobile device management (MDM) system to centrally manage mobile devices that support the service.

The company enforces appropriate sanctions against workforce members who fail to comply with its security policies and procedures.

The company identifies and responds to suspected or known security incidents, mitigates harmful effects to the extent practicable, and documents the incidents along with their outcomes.

The organization conducts regular reviews to ensure compliance with its information security policy, topic-specific policies, rules, and standards.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company maintains a formal inventory of assets within the production environment.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

The company reviews data center access at least once a year.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company uses a mobile device management (MDM) system to centrally manage mobile devices that support the service.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company conducts maintenance inspections of environmental security measures at its data centers at least once a year.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company assesses the relative criticality of specific applications and data to support the development and execution of other contingency plan components.

The company has established policies and procedures to document all repairs and modifications to the physical components of its facilities that relate to security, including items such as hardware, walls, doors, and locks.

The organization ensures that equipment is properly maintained to support the availability, integrity, and confidentiality of information.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company has a documented Business Continuity and Disaster Recovery (BC/DR) plan, which is tested at least once a year.

The company has a configuration management procedure to ensure consistent deployment of system configurations across the environment.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company’s access control policy outlines requirements for the following access control functions: 1. Adding new users 2. Modifying users 3. Removing user access

The company requires changes to software and infrastructure components to be authorized, documented, tested, reviewed, and approved before being implemented in the production environment.

The company’s data backup policy defines the requirements for backing up and recovering customer data.

The company restricts production change migrations to authorized personnel only.

The company requires authentication to production datastores to use authorized secure methods, such as unique SSH keys.

The company limits privileged access to encryption keys to authorized users who have a valid business need.

The company has a data classification policy to ensure confidential data is properly secured and accessible only to authorized personnel.

System access is restricted to authorized users only.

The company limits privileged access to the operating system to authorized users with a valid business need.

The company limits privileged access to the production network to authorized users with a valid business need.

The company requires authentication to the production network to use unique usernames and passwords or authorized SSH keys.

The company’s network is segmented to block unauthorized access to customer data.

The company purges or removes customer data containing confidential information from the application environment in accordance with best practices when customers discontinue the service.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company reviews firewall rulesets at least once a year, with required changes tracked to completion.

The company uses firewalls configured to block unauthorized access.

The company patches infrastructure supporting the service as part of routine maintenance and in response to identified vulnerabilities to help ensure servers are hardened against security threats.

The company uses a mobile device management (MDM) system to centrally manage mobile devices that support the service.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

The company ensures that customer transaction data cannot be modified by either customers or administrators within the production application.

The company validates deletion requests, and once confirmed, flags and deletes the requested information in accordance with applicable laws and regulations.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company has implemented hardware, software, and procedural mechanisms to log and review activity within information systems that store or process electronic Protected Health Information (ePHI).

The company deletes or de-identifies data when it is no longer required for the purposes for which it was originally collected or processed, in accordance with data retention and minimization principles.

The company establishes and enforces firewall and router configuration standards that include a documented process for approving and testing all network connections, as well as any changes to firewall and router configurations.

The company ensures that audit trails are enabled and active on all system components to record relevant security events.

For public-facing web applications, the company addresses new threats and vulnerabilities on an ongoing basis and protects these applications against known attacks by implementing one of the following methods: 1. Conducting manual or automated application vulnerability assessments that: a) Occur at least annually and after any changes b) Are performed by organizations specializing in application security c) Include all vulnerabilities d) Ensure that all identified vulnerabilities are corrected e) Include re-evaluation of the application following remediation 2. Deploying an automated technical solution, such as a web application firewall, that: a) Is positioned in front of public-facing web applications to detect and prevent attacks b) Is actively running and kept up to date c) Generates audit logs d) Is configured to either block detected web-based attacks or generate alerts that are promptly investigated

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The organization uses DNS filtering services on all end-user devices, including remote and on-premises assets, to block access to known malicious domains.

The organization enforces and updates network-based URL filters to prevent enterprise assets from connecting to potentially malicious or unapproved websites. Implementations may include category-based filtering, reputation-based filtering, or block lists. Filters are enforced for all enterprise assets.

The organization should specify and maintain documented requirements for new AI systems and for material enhancements to existing systems.

The organization shall limit system access exclusively to authorized users, processes operating on behalf of authorized users, and approved devices, including interconnected systems.

The organization shall require multi-factor authentication for both local and network access to privileged accounts, and for network access to non-privileged accounts.

Where a product incorporates an AI system and is subject both to the requirements of this Regulation and to the requirements of applicable Union harmonisation legislation, the provider shall be responsible for ensuring that the product complies in full with all applicable requirements under that Union harmonisation legislation. When ensuring that high-risk AI systems comply with the requirements set out in this Section, providers may, for the purpose of ensuring consistency, avoiding duplication, and minimising additional burdens, choose to integrate the relevant testing and reporting activities, as well as the information and documentation relating to the AI system, into existing documentation and procedures required under the applicable Union harmonisation legislation.

Persons who use closed systems to create, modify, maintain, or transmit electronic records shall validate those systems for accuracy, reliability, consistent intended performance, and the ability to detect invalid or altered records.