TRUST CENTER / CONTROLS
Security, in practice.
A structured approach to protecting information, managing risk, and operating responsibly.
Asset management4 controls+
- Secure media disposal
- Technology asset inventory
- Technology asset inventory ownership
- ePHI preservation during system changes
Business continuity & disaster recovery6 controls+
- Continuity of emergency operations
- Business continuity and disaster recovery plan
- Multi-availability-zone deployment
- Database backups
- Emergency ePHI access procedures
- ePHI backup and recovery testing
Capacity & performance planning1 controls+
- Capacity and performance monitoring
Change management2 controls+
- Customer notification of material changes
- Material system change communications
Cloud security2 controls+
- Cloud provider physical access review
- Cloud service security
Compliance3 controls+
- HIPAA Security Rule policy acknowledgement
- HIPAA document retention
- Documented compliance requirements
Configuration management1 controls+
- Baseline configuration management
Continuous monitoring2 controls+
- Centralized log collection and monitoring
- Login attempt monitoring
Cryptographic protections3 controls+
- Production key management
- Encryption at rest
- Encryption in transit
Cybersecurity & data privacy governance16 controls+
- Board security briefings
- Annual strategic planning
- Governance committee charter
- Security roles and responsibilities
- Information security policies
- Board and steering committee charter
- Board and steering committee briefings
- Role and responsibility definitions
- Organizational structure documentation
- ISMS scope definition
- Information security officer appointment
- HIPAA security officer designation
- IT leadership committee meetings
- Whistleblower mechanism
- Interested-party security requirements
- Intellectual property protection
Data classification & handling3 controls+
- Data classification and access controls
- Data retention and deletion policies
- Customer data deletion
Data privacy30 controls+
- Data transfer safeguards
- Internal GDPR compliance assessment
- Lawfulness assessments
- Data protection impact assessments
- Automated decision-making policies
- Privacy requirements register
- Age verification and parental consent
- Data sharing agreements
- Anonymization and pseudonymization
- Criminal data processing policies
- Privacy-by-design development
- Data processing agreements
- Records of processing activities
- Explicit consent collection
- Data portability requests
- Personal data subprocessor inventory
- Erasure request management
- Joint controller agreements
- Privacy policy
- Transfers based on derogations
- Processing without identification
- Data governance framework
- Breach communication templates
- Centralized data subject requests
- Data subject request response timelines
- Data protection officer appointment
- EU representative appointment
- Objection request management
- Rectification request management
- Rectification and erasure notifications
Endpoint security4 controls+
- Anti-malware protection
- Removable media controls
- Remote work policies
- Secure workstation configuration
Human resources security8 controls+
- Employee confidentiality agreements
- Disciplinary process
- Employee code of conduct acknowledgement
- Contractor code of conduct acknowledgement
- Access revocation upon termination
- Contractor background checks
- Employee background checks
- Performance reviews
Identification & authentication9 controls+
- ePHI access authorization and monitoring
- Production access management
- Access control procedures
- Infrastructure authentication
- Quarterly access reviews
- Least-privilege production access
- Password policies
- Multi-factor authentication
- Session timeout enforcement
Incident response5 controls+
- Incident response procedures
- Security issue resolution
- Security incident logs
- HIPAA incident response policies
- Regulatory communications
Information assurance3 controls+
- Internal audit program
- Security documentation availability
- Internal audit planning
Mobile device management1 controls+
- Mobile device management
Network security4 controls+
- Secure connection requirements
- Network firewalls
- Firewall rule management
- Network architecture documentation
Physical & environmental security3 controls+
- Visitor management
- Clear desk and clear screen policies
- Cabling and utility security
Project & resource management1 controls+
- Security in project management
Risk management5 controls+
- Security and privacy risk management
- Annual risk assessments
- Documented security and privacy risk process
- Risk assessment review
- Cybersecurity insurance
Secure engineering & architecture6 controls+
- Environment and tenant segmentation
- Source code access controls
- Source code change approval
- Static application security testing
- Environment separation
- Secure development processes
Security awareness & training2 controls+
- Security awareness training
- ePHI privacy training
Security operations3 controls+
- Intrusion detection
- Time synchronization
- Customer support availability
Third-party management11 controls+
- Penetration testing
- Vendor confidentiality and privacy agreements
- Contractor confidentiality agreements
- Contractual security commitments
- Business associate agreements
- ePHI breach notification timelines
- Vendor management program
- Business associate breach notifications
- Business associate safeguards
- Contractor compliance flow-down
- Outsourced development security
Threat management1 controls+
- Security community participation
Vulnerability & patch management2 controls+
- Vulnerability scanning and remediation
- Patch management
Web security1 controls+
- Web application firewall
Continual improvement6 controls+
- Continual improvement and corrective action
- Management reviews
- ISMS organizational context
- ISMS interested-party management
- Annual security policy acknowledgement
- Monitoring, measurement, analysis and evaluation