Data Security Systems Internal Control Questionnaire

Size: px
Start display at page:

Download "Data Security Systems Internal Control Questionnaire"

Transcription

1 Data Security Systems Internal Control Questionnaire I. GENERAL DATA SECURITY SYSTEM A. Does security system management: 1. Determine how access levels are granted? 2. Define when access is granted unless the data set is specifically restricted? 3. If appropriate, restrict all access unless specifically authorized? 4. Establish how password files are controlled (i.e., encrypted)? 5. Ensure security violations are detected and reported (e.g., restrict access but do not report, allow access and report, restrict access and report)? 6. Detail what applications and data sets are protected by the system? 7. Establish controls, if exits or other methods exist for bypassing the security restrictions? II. DATA SECURITY PRACTICES Access levels A. Are users restricted as to: 1. What files they can access? 2. What transactions they can initiate? B. Are access levels commensurate with job assignments, to include specifically that: 1. Data entry is separated from file maintenance? 2. File maintenance is performed at a supervisory level or under documented supervisory review? 3. Individual users are restricted to application files and functions related to their job responsibility? C. Are levels of access approved and periodically reviewed by management? D. Are procedures in place to address personnel transfers, new hires, and terminations? E. Are procedures in place to prevent online programming from changing or testing against live files? F. Is supervisory approval required for terminal access made at other than authorized times? IT B13-1

2 Password Controls A. Is maintenance of the security profile/password file independent from systems/application programming and audit? 1. Is activity to such files reviewed by an individual not responsible for its maintenance? B. Are passwords, user IDs, and encryption key procedures adequately controlled as to: 1. The assignment of passwords? 2. Changing passwords on a regular and frequent basis? 3. Suppressing passwords and IDs on the video screen and all printed output? 4. Encryption of password files? C. Are passwords required to be alphanumeric or in some other format that is difficult to guess? Terminal Controls A. Is access to the system by terminals appropriately controlled by: 1. Terminal locks? 2. Terminal identification checks? 3. A physically secure location? 4. User identification? 5. Automatic time-outs? 6. Time of day? B. Are all terminals controlled as to: 1. What files they can access? 2. What transactions they can initiate? C. Does the system assure that all transmissions are received from only authorized terminals and users (e.g., polling list, user ID/password, call-back)? D. Are dial-up phone numbers periodically changed? E. Are dial-up lines controlled by either an automatic call-back procedure or physical connection (manual intercept) by operations personnel at the data center? Audit Trails/Monitoring A. Is a transaction file maintained for all messages received from all terminals identifying: 1. The terminal? 2. The user? 3. Transaction detail? 4. Date and time of day? B13-2 IT

3 B. Is a detailed record automatically generated by the system to document all online access and modifications to program libraries? 1. Are such records adequately reviewed for propriety? C. Are reports generated that record: 1. Unusual activity? 2. Unsuccessful attempts to gain access to the teleprocessing system or applications? 3. Teleprocessing network problems/statistics? D. Are exception reports reviewed regularly by management or data security personnel for follow-up action? III. DATA ENTRY CONTROLS A. Are training materials, including user manuals or preprogrammed user instructions, available to all terminal operators? B. Is terminal input subject to automatic editing to reduce input errors? C. Is there daily input balancing to each terminal or user in the system? D. Are correcting and reversing entries, as well as overrides, approved at a supervisory level? IV. BACKUP A. Are data communications facilities backed up by one or more of the following methods: 1. Replaceable by batch processing? 2. Alternate data lines (e.g., dial-up)? 3. Backup modems at critical locations? 4. Other (describe)? B. Are backup provisions periodically tested? C. Have policies been established for source document retention to support terminal-initiated transactions? V. NETWORK DATA SECURITY A. Must all users on the network enter a log-on ID and password to access the network server? B. Are appropriate password and log-on controls in force? 1. Are the passwords displayed or hidden (nonclear) when they are entered? 2. Are the passwords encrypted at the workstation before being sent to the server for verification? IT B13-3

4 3. Does the system force the user to change passwords regularly? Describe the frequency of change: 4. Are IDs automatically disabled by the system if passwords are not changed by users? 5. Does the system prevent passwords from being reused, and are users prevented from changing back to previously used passwords? 6. Are new users forced to enter a new password on initial log-on (passwords preexpired at first log-on)? 7. Is a minimum-length password enforced by the system? 8. Is there a system to authenticate and preview passwords to prevent common word/name usage (dictionary type password authentication prevention controls)? 9. Are passwords stored as clear text anywhere on the network, including the workstations or in the server? 10. Are user IDs automatically logged off the network after a period of inactivity? 11. Are group or shared IDs and passwords permitted on the network? 12. Do compensating controls exist for the use of group or shared IDs and passwords? 13. Do employees sign a corporate systems policy statement acknowledging responsibility for confidentiality of information and secrecy of passwords? 14. Are users informed through guidelines, and are they educated about security and establishing passwords? 15. Are vendor, contractor, or temporary employee IDs set to expire at the term of the contract? 16. Are vendors, contractors, or temporary employees restricted to appropriate log-on days and times? 17. Are vendors, contractors, or temporary employees restricted to specific workstations? 18. Are vendors, contractors, or temporary employees required to sign appropriate nondisclosure statements regarding corporate information to which they may have access? 19. Are IDs disabled after several failed log-on attempts? What is the frequency of failed attempts that disables the ID? How long are IDs disabled and how are they restored? 20. Are users notified of the number of prior invalid log-on attempts each time they sign onto the system? C. Are there password log-on audit trails that show activity such as: 1. Log-ons and log-offs (location, time, and user ID)? 2. Type of access (dial-up, leased lines, public data networks, etc.)? 3. Invalid access attempts (location, date, time, ID)? B13-4 IT

5 4. System expired IDs? 5. Log-offs due to inactivity? D. Are audit trails maintained for a reasonable time? 1. Are they reviewed? Note by whom: Note how frequently: 2. Is action taken, if required? Describe steps taken: E. Are exception reports produced from audit trails and reviewed by management? F. Does the network software prevent access by unauthorized users to or from other network services (gateway, fax, dial-out, WAN, etc.)? G. Does the network software prevent access by unauthorized users to sensitive system functions such as security administration, network monitoring, server console operations, and enabling/disabling services? H. Are users granted access only to disks, volumes, directories, and files for which they are specifically authorized? I. Are users able to load and run only those executables they are specifically authorized to load and run? J. Are there software security controls that are not integral to the network s operation system? Describe such controls: 1. Are controls over such software effective and do they ensure that only authorized persons can figure or defeat control features? VI. NETWORK COMMUNICATIONS SECURITY A. Are internal controls adequate to prevent the following? 1. Incomplete transmission 2. Misrouting 3. Unauthorized message alteration 4. Unauthorized disclosure 5. Message duplication B. Is communication security built into the communication links on the network, including: 1. Software packages? 2. Encryption devices? 3. Hardware features for the various servers and other processing devices? IT B13-5

6 C. If the network is connected to outside services or related services through the Internet, have firewalls been created to centralize access control to and from the network and the other service? D. Are microcomputers connected to each other and other processing entities by different methods, including the following: 1. Modems? a. Direct dial-up? b. Dial-back? 2. Hardwired (direct connect)? 3. Leased lines? 4. Public data networks? E. Are adequate controls implemented over communications hardware/software processing functions, including the following: 1. Network change control? 2. Dial-up access? 3. Network activity logging? 4. Data encryption? F. Are controls in place to ensure that data integrity is maintained during data transfer to or from the client/server and other processing entities? 1. Do implemented controls identify: a. The message authentication procedure? b. How the accuracy and completeness of a transmission are assured? c. For data up- and downloading, how batches are identified, screened, and approved on the network? VII. CHANGE CONTROL A. Do procedures exist for operations staff to manage change control to database systems? B. Do formal program change procedures include the following: 1. Does the database program change process conform to corporate program change control procedures and standards? 2. Is program change control for the network operation adequate? 3. Are the techniques used to monitor program change control adequate? 4. Do the systems change control procedures take into account the impact to the business, including system availability, user impact, system efficiency, and accuracy of documentation and manuals? B13-6 IT

7 5. Are there adequate procedures to inform, train, and assist operations staff in the implementation and support of changes in the system? C. Do procedures exist to inform and train users when database system changes occur? D. For network systems and utilities, are the following provided: 1. Maintenance information? a. Technical support group that supports the product? b. Contract or agreement governing maintenance procedures and services response availability? c. User documentation? 2. Is current technical and reference documentation available for operation, administration, and users of the network system software and utilities? E. Do adequate test procedures exist for all changes to the customer database system environment, including those to: 1. Test and implement system upgrades, patches, fixes, and enhancements? 2. Test and implement application upgrades, fixes, and enhancements? 3. Test and implement the introduction of new productivity tools and programs? 4. Test and implement changes in the physical environment? F. Does an adequately configured test system exist with appropriate isolation to the production environment? 1. If not, does a logical test system exist? 2. Do appropriate controls exist to prevent significant adverse impact to system efficiency or availability? 3. Do specific procedures exist to guard against the introduction of viruses or otherwise tainted executable programs in the test and production environments? VIII. TRAINING AND USER EDUCATION A. Are policies and procedures in place to ensure adequate technical training of users, operators, and staff? B. Does adequate documentation exist for use in training and as reference material for all system and application functions? C. Are security and control concerns part of the education and training programs for users, staff, and operators of the system? D. Are corporate information systems policies communicated to personnel relative to training programs and materials? E. Are changes to the system accounted for in training and education programs, including documentation and work aids? IT B13-7

8 B13-8 IT

PREPARED BY: AUDIT PROGRAM Author: Lance M. Turcato. APPROVED BY: Logical Security Operating Systems - Generic. Audit Date:

PREPARED BY: AUDIT PROGRAM Author: Lance M. Turcato. APPROVED BY: Logical Security Operating Systems - Generic. Audit Date: A SYSTEMS UNDERSTANDING A 1.0 Organization Objective: To ensure that the audit team has a clear understanding of the delineation of responsibilities for system administration and maintenance. A 1.1 Determine

More information

Payment Systems and Funds Transfer Internal Control Questionnaire

Payment Systems and Funds Transfer Internal Control Questionnaire Payment Systems and Funds Transfer Internal Control Questionnaire Completed by: Date Completed: I. ORGANIZATION 1. Has a written wire transfer policy been approved by the board of directors? 2. Has a current

More information

General Computer Controls

General Computer Controls 1 General Computer Controls Governmental Unit: University of Mississippi Financial Statement Date: June 30, 2007 Prepared by: Robin Miller and Kathy Gates Date: 6/29/2007 Description of computer systems

More information

SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This

More information

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results

IT General Controls Domain COBIT Domain Control Objective Control Activity Test Plan Test of Controls Results Acquire or develop application systems software Controls provide reasonable assurance that application and system software is acquired or developed that effectively supports financial reporting requirements.

More information

INFORMATION TECHNOLOGY CONTROLS

INFORMATION TECHNOLOGY CONTROLS CHAPTER 14 INFORMATION TECHNOLOGY CONTROLS SCOPE This chapter addresses requirements common to all financial accounting systems and is not limited to the statewide financial accounting system, ENCOMPASS,

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

IT Security Procedure

IT Security Procedure IT Security Procedure 1. Purpose This Procedure outlines the process for appropriate security measures throughout the West Coast District Health Board (WCDHB) Information Systems. 2. Application This Procedure

More information

CHIS, Inc. Privacy General Guidelines

CHIS, Inc. Privacy General Guidelines CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified

More information

CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS

CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS 11-1 CHAPTER 11 COMPUTER SYSTEMS INFORMATION TECHNOLOGY SERVICES CONTROLS INTRODUCTION The State Board of Accounts, in accordance with State statutes and the Statements on Auditing Standards Numbers 78

More information

Internet Banking Internal Control Questionnaire

Internet Banking Internal Control Questionnaire Internet Banking Internal Control Questionnaire Completed by: Date Completed: 1. Has the institution developed and implemented a sound system of internal controls over Internet banking technology and systems?

More information

Information Systems Access Policy

Information Systems Access Policy Information Systems Access Policy I. PURPOSE The purpose of this policy is to maintain an adequate level of security to protect data and information systems from unauthorized access. This

More information

Information Technology General Controls Review (ITGC) Audit Program Prepared by:

Information Technology General Controls Review (ITGC) Audit Program Prepared by: Information Technology General Controls Review (ITGC) Audit Program Date Prepared: 2012 Internal Audit Work Plan Objective: IT General Controls (ITGC) address the overall operation and activities of the

More information

The Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3

The Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3 Table of Contents 1 Acceptable use 1 Violations 1 Administration 1 Director and Supervisor Responsibilities 1 MIS Director Responsibilities 1 The Internet and e-mail 2 Acceptable use 2 Unacceptable use

More information

Information Technology Cyber Security Policy

Information Technology Cyber Security Policy Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please

More information

DHHS Information Technology (IT) Access Control Standard

DHHS Information Technology (IT) Access Control Standard DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of

More information

Access Control BUSINESS REQUIREMENTS FOR ACCESS CONTROL

Access Control BUSINESS REQUIREMENTS FOR ACCESS CONTROL AU7087_C013.fm Page 173 Friday, April 28, 2006 9:45 AM 13 Access Control The Access Control clause is the second largest clause, containing 25 controls and 7 control objectives. This clause contains critical

More information

IT - General Controls Questionnaire

IT - General Controls Questionnaire IT - General Controls Questionnaire Internal Control Questionnaire Question Yes No N/A Remarks G1. ACCESS CONTROLS Access controls are comprised of those policies and procedures that are designed to allow

More information

Information Technology Branch Access Control Technical Standard

Information Technology Branch Access Control Technical Standard Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,

More information

Full Compliance Contents

Full Compliance Contents Full Compliance for and EU Annex 11 With the regulation support of Contents 1. Introduction 2 2. The regulations 2 3. FDA 3 Subpart B Electronic records 3 Subpart C Electronic Signatures 9 4. EU GMP Annex

More information

ISO27001 Controls and Objectives

ISO27001 Controls and Objectives Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the

More information

FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review.

FIREWALL CHECKLIST. Pre Audit Checklist. 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 1. Obtain previous workpapers/audit reports. FIREWALL CHECKLIST Pre Audit Checklist 2. Obtain the Internet Policy, Standards, and Procedures relevant to the firewall review. 3. Obtain current network diagrams

More information

General IT Controls Audit Program

General IT Controls Audit Program Contributed February 5, 2002 by Paul P Shotter General IT Controls Audit Program Purpose / Scope Perform a General Controls review of Information Technology (IT). The reviews

More information

6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING

6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING 6. AUDIT CHECKLIST FOR NETWORK ADMINISTRATION AND SECURITY AUDITING The following is a general checklist for the audit of Network Administration and Security. Sl.no Checklist Process 1. Is there an Information

More information

Technical Standards for Information Security Measures for the Central Government Computer Systems

Technical Standards for Information Security Measures for the Central Government Computer Systems Technical Standards for Information Security Measures for the Central Government Computer Systems April 21, 2011 Established by the Information Security Policy Council Table of Contents Chapter 2.1 General...

More information

Policy Title: HIPAA Access Control

Policy Title: HIPAA Access Control Policy Title: HIPAA Access Control Number: TD-QMP-7018 Subject: Ensuring that access to EPHI is only available to those persons or programs that have been appropriately granted such access. Primary Department:

More information

HIPAA Information Security Overview

HIPAA Information Security Overview HIPAA Information Security Overview Security Overview HIPAA Security Regulations establish safeguards for protected health information (PHI) in electronic format. The security rules apply to PHI that is

More information

Local Area Networking

Local Area Networking Local Area Networking prashant.mali@cyberlawconsulting.com By Prashant Mali LAN Issues Local Area Networks evolved from stand-alone PCs Control and safety features found commonly in multi-user systems

More information

PART 10 COMPUTER SYSTEMS

PART 10 COMPUTER SYSTEMS PART 10 COMPUTER SYSTEMS 10-1 PART 10 COMPUTER SYSTEMS The following is a general outline of steps to follow when contemplating the purchase of data processing hardware and/or software. The State Board

More information

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225

More information

HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics

HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards

More information

TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices

TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security

More information

Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis

Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University

More information

Remote Deposit Terms of Use and Procedures

Remote Deposit Terms of Use and Procedures Remote Deposit Terms of Use and Procedures Use of American National Bank Fox Cities (Bank) Remote Deposit service is subject to the following Terms of Use and Procedures. Bank reserves the right to update

More information

Agilent MicroLab Software with Spectroscopy Configuration Manager and Spectroscopy Database Administrator (SCM/SDA)

Agilent MicroLab Software with Spectroscopy Configuration Manager and Spectroscopy Database Administrator (SCM/SDA) Agilent MicroLab Software with Spectroscopy Configuration Manager and Spectroscopy Database Administrator (SCM/SDA) Compliance with 21 CFR Part 11 Introduction Part 11 in Title 21 of the Code of Federal

More information

SRA International Managed Information Systems Internal Audit Report

SRA International Managed Information Systems Internal Audit Report SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...

More information

DETAIL AUDIT PROGRAM Information Systems General Controls Review

DETAIL AUDIT PROGRAM Information Systems General Controls Review Contributed 4/23/99 by Steve_Parker/TBE/Teledyne@teledyne.com DETAIL AUDIT PROGRAM Information Systems General Controls Review 1.0 Introduction The objectives of this audit are to review policies, procedures,

More information

PCI Data Security and Classification Standards Summary

PCI Data Security and Classification Standards Summary PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers

More information

Virginia Commonwealth University School of Medicine Information Security Standard

Virginia Commonwealth University School of Medicine Information Security Standard Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Data Handling and Storage Standard This standard is applicable to all VCU School of Medicine personnel. Approval

More information

HIPAA Security COMPLIANCE Checklist For Employers

HIPAA Security COMPLIANCE Checklist For Employers Compliance HIPAA Security COMPLIANCE Checklist For Employers All of the following steps must be completed by April 20, 2006 (April 14, 2005 for Large Health Plans) Broadly speaking, there are three major

More information

Computer Security Policy (Interim)

Computer Security Policy (Interim) Computer Security Policy (Interim) Updated May, 2001 Department of Information Systems & Telecommunications Table of Contents 1. SCOPE...1 2. OVERVIEW...1 3. RESPONSIBILITIES...3 4. PHYSICAL SECURITY...4

More information

Vermont Information Technology Leaders

Vermont Information Technology Leaders Vermont Information Technology Leaders HIPAA COMPLIANCE POLICIES AND PROCEDURES Policy Number: InfoSec 1 Policy Title: Information Privacy and Security Management Process IDENT INFOSEC1 Type of Document:

More information

Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed)

Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed) Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed) 01.1 Purpose

More information

Appendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice

Appendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice Appendix 4-2: Administrative, Physical, and Technical Safeguards Breach Notification Rule How Use this Assessment The following sample risk assessment provides you with a series of sample questions help

More information

Information Systems and Technology

Information Systems and Technology As public servants, it is our responsibility to use taxpayers dollars in the most effective and efficient way possible while adhering to laws and regulations governing those processes. There are many reasons

More information

Agilent UV-Visible ChemStation with Security Pack

Agilent UV-Visible ChemStation with Security Pack Agilent UV-Visible ChemStation with Security Pack Compliance with 21 CFR Part 11 Introduction Part 11 in Title 21 of the Code of Federal Regulations includes the US Federal guidelines for storing and protecting

More information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1

More information

HIPAA: The Role of PatientTrak in Supporting Compliance

HIPAA: The Role of PatientTrak in Supporting Compliance HIPAA: The Role of PatientTrak in Supporting Compliance The purpose of this document is to describe the methods by which PatientTrak addresses the requirements of the HIPAA Security Rule, as pertaining

More information

HIPAA Security Alert

HIPAA Security Alert Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information

More information

System Security Plan Template

System Security Plan Template Institutional and Sector Modernisation Facility ICT Standards System Security Plan Template Document number: ISMF-ICT/3.03 - ICT Security/MISP/SD/SSP Template Version: 1.20 Project Funded by the European

More information

GFI White Paper PCI-DSS compliance and GFI Software products

GFI White Paper PCI-DSS compliance and GFI Software products White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption

More information

Security Compliance Assessment Checklist

Security Compliance Assessment Checklist Security Compliance Assessment Checklist ITO Security Services January 2011 V0.2 Intro This checklist is used to evaluate project compliance with the Government of Saskatchewan IT Security Standards 2010.

More information

MUSC Information Security Policy Compliance Checklist for System Owners Instructions

MUSC Information Security Policy Compliance Checklist for System Owners Instructions Instructions This checklist can be used to identify gaps in compliance with MUSC's information security policies and standards, which are published on the Web at http://www.musc.edu/security. Each of the

More information

Supplier Information Security Addendum for GE Restricted Data

Supplier Information Security Addendum for GE Restricted Data Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,

More information

Application Security Questionnaire. Application Name Vendor Version Release Date. Name Title Department. Company Name Telephone #

Application Security Questionnaire. Application Name Vendor Version Release Date. Name Title Department. Company Name Telephone # Instructions: Check the appropriate column to indicate the application s security capabilities. Please provide any additional responses or detailed explanations of other compensating controls as comments.

More information

LogMeIn HIPAA Considerations

LogMeIn HIPAA Considerations LogMeIn HIPAA Considerations Contents Introduction LogMeIn HIPAA Considerations...3 General HIPAA Information...4 Section A Background information on HIPAA Rules...4 Technical Safeguards Overview...5 Section

More information

Policies and Procedures Audit Checklist for HIPAA Privacy, Security, and Breach Notification

Policies and Procedures Audit Checklist for HIPAA Privacy, Security, and Breach Notification Policies and Procedures Audit Checklist for HIPAA Privacy, Security, and Breach Notification Type of Policy and Procedure Comments Completed Privacy Policy to Maintain and Update Notice of Privacy Practices

More information

University of Pittsburgh Security Assessment Questionnaire (v1.5)

University of Pittsburgh Security Assessment Questionnaire (v1.5) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided

More information

Information Security Policy September 2009 Newman University IT Services. Information Security Policy

Information Security Policy September 2009 Newman University IT Services. Information Security Policy Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms

More information

HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005

HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 INTRODUCTION HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as a

More information

HIPAA: In Plain English

HIPAA: In Plain English HIPAA: In Plain English Material derived from a presentation by Kris K. Hughes, Esq. Posted with permission from the author. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub.

More information

Empower TM 2 Software

Empower TM 2 Software Empower TM 2 Software 21 CFR PART 11 COMPLIANCE ASSESSMENT Revision A, December, 2005 1 of 14 Waters Corporation Note: Information presented in this document assumes that the appropriate Empower 2 System

More information

Newcastle University Information Security Procedures Version 3

Newcastle University Information Security Procedures Version 3 Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations

More information

Spillemyndigheden s Certification Programme Information Security Management System

Spillemyndigheden s Certification Programme Information Security Management System SCP.03.00.EN.1.0 Table of contents Table of contents... 2 1 Objectives of the... 3 1.1 Scope of this document... 3 1.2 Version... 3 2 Certification... 3 2.1 Certification frequency... 3 2.1.1 Initial certification...

More information

c) Password Management The assignment/use of passwords is controlled in accordance with the defined Password Policy.

c) Password Management The assignment/use of passwords is controlled in accordance with the defined Password Policy. Responsible Office: Chief Information Officer Pages of these Procedures 1 of 5 Procedures of Policy No. (2) - 1. User Access Management a) User Registration The User ID Registration Procedure governs the

More information

NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS

NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS NETWORK AND CERTIFICATE SYSTEM SECURITY REQUIREMENTS Scope and Applicability: These Network and Certificate System Security Requirements (Requirements) apply to all publicly trusted Certification Authorities

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center Portable Security Computing No: Effective: OSC-09 05/27/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original Publication

More information

Name: Position held: Company Name: Is your organisation ISO27001 accredited:

Name: Position held: Company Name: Is your organisation ISO27001 accredited: Third Party Information Security Questionnaire This questionnaire is to be completed by the system administrator and by the third party hosting company if a separate company is used. Name: Position held:

More information

M E M O R A N D U M. Revised Information Technology Security Procedures INFORMATION TECHNOLOGY SECURITY PROCEDURES. I. General

M E M O R A N D U M. Revised Information Technology Security Procedures INFORMATION TECHNOLOGY SECURITY PROCEDURES. I. General M E M O R A N D U M To: From: IT Steering Committee Brian Cohen Date: March 26, 2009 Subject: Revised Information Technology Security Procedures The following is a revised version of the Information Technology

More information

Managed Hosting & Datacentre PCI DSS v2.0 Obligations

Managed Hosting & Datacentre PCI DSS v2.0 Obligations Any physical access to devices or data held in an Melbourne datacentre that houses a customer s cardholder data must be controlled and restricted only to approved individuals. PCI DSS Requirements Version

More information

Walton Centre. Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure

Walton Centre. Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure Page 1 Walton Centre Access and Authentication (network) Document History Date Version Author Changes 01/10/04 1.0 A Cobain L Wyatt 31/03/05 1.1 L Wyatt Update to procedure Page 2 Table of Contents Section

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

Main Reference : Hall, James A. 2011. Information Technology Auditing and Assurance, 3 rd Edition, Florida, USA : Auerbach Publications

Main Reference : Hall, James A. 2011. Information Technology Auditing and Assurance, 3 rd Edition, Florida, USA : Auerbach Publications Main Reference : Hall, James A. 2011. Information Technology Auditing and Assurance, 3 rd Edition, Florida, USA : Auerbach Publications Suggested Reference : Senft, Sandra; Gallegos, Frederick., 2009.

More information

IT Security Standard: Computing Devices

IT Security Standard: Computing Devices IT Security Standard: Computing Devices Revision History: Date By Action Pages 09/30/10 ITS Release of New Document Initial Draft Review Frequency: Annually Responsible Office: ITS Responsible Officer:

More information

Telemedicine HIPAA/HITECH Privacy and Security

Telemedicine HIPAA/HITECH Privacy and Security Telemedicine HIPAA/HITECH Privacy and Security 1 Access Control Role Based Access The organization shall provide secure rolebased account management. Privileges granted utilizing the principle of least

More information

Data Management Policies. Sage ERP Online

Data Management Policies. Sage ERP Online Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...

More information

CrossBow NERC CIP Compliance Matrix

CrossBow NERC CIP Compliance Matrix Section Requirement CIP-002-1 Cyber Security Critical Cyber Asset Identification R3, M3 the Responsible Entity shall develop a list of associated Critical Cyber Assets essential to the operation of the

More information

An Introduction to HIPAA and how it relates to docstar

An Introduction to HIPAA and how it relates to docstar Disclaimer An Introduction to HIPAA and how it relates to docstar This document is provided by docstar to our partners and customers in an attempt to answer some of the questions and clear up some of the

More information

INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc.

INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc. INFORMATION SECURITY SPECIFIC VENDOR COMPLIANCE PROGRAM (VCP) ACME Consulting Services, Inc. Copyright 2016 Table of Contents INSTRUCTIONS TO VENDORS 3 VENDOR COMPLIANCE PROGRAM OVERVIEW 4 VENDOR COMPLIANCE

More information

HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE

HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE How to Use this Assessment The following risk assessment provides you with a series of questions to help you prioritize the development and implementation

More information

ICT USER ACCOUNT MANAGEMENT POLICY

ICT USER ACCOUNT MANAGEMENT POLICY ICT USER ACCOUNT MANAGEMENT POLICY Version Control Version Date Author(s) Details 1.1 23/03/2015 Yaw New Policy ICT User Account Management Policy 2 Contents 1. Preamble... 4 2. Terms and definitions...

More information

Information Systems Security Assessment

Information Systems Security Assessment Physical Security Information Systems Security Assessment 1. Is the server protected from environmental damage (fire, water, etc.)? Ideal Answer: YES. All servers must be housed in such a way as to protect

More information

Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security

Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security Welcome to part 2 of the HIPAA Security Administrative Safeguards presentation. This presentation covers information access management, security awareness training, and security incident procedures. The

More information

A Nemaris Company. Formal Privacy & Security Assessment For Surgimap version 2.2.6 and higher

A Nemaris Company. Formal Privacy & Security Assessment For Surgimap version 2.2.6 and higher A Nemaris Company Formal Privacy & Security Assessment For Surgimap version 2.2.6 and higher 306 East 15 th Street Suite 1R, New York, New York 10003 Application Name Surgimap Vendor Nemaris Inc. Version

More information

Application Development within University. Security Checklist

Application Development within University. Security Checklist Application Development within University Security Checklist April 2011 The Application Development using data from the University Enterprise Systems or application Development for departmental use security

More information

Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite. www.lepide.com/2020-suite/

Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite. www.lepide.com/2020-suite/ Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite 7. Restrict access to cardholder data by business need to know PCI Article (PCI DSS 3) Report Mapping How we help 7.1 Limit access to system

More information

ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access. Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access

ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access. Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access Policy Title: Remote Access Policy Type: Administrative Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access Approval Date: 05/20/2014 Revised Responsible Office: Office of Information

More information

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable

More information

Electronic business conditions of use

Electronic business conditions of use Electronic business conditions of use This document provides Water Corporation s Electronic Business Conditions of Use. These are to be applied to all applications, which are developed for external users

More information

REGULATIONS COMPLIANCE ASSESSMENT

REGULATIONS COMPLIANCE ASSESSMENT ALIX is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation. REGULATIONS COMPLIANCE ASSESSMENT BUSINESS

More information

NETWRIX IDENTITY MANAGEMENT SUITE

NETWRIX IDENTITY MANAGEMENT SUITE NETWRIX IDENTITY MANAGEMENT SUITE FEATURES AND REQUIREMENTS Product Version: 3.3 February 2013. Legal Notice The information in this publication is furnished for information use only, and does not constitute

More information

Security Plan Checklist (SPC) October 2011

Security Plan Checklist (SPC) October 2011 October 2011 Security Plan Checklist Overview The SPC is meant for technical reviewers/developers of security plans in State health and human services agencies; based on guidance from NIST*, FIPS*, and

More information

Procedure Title: TennDent HIPAA Security Awareness and Training

Procedure Title: TennDent HIPAA Security Awareness and Training Procedure Title: TennDent HIPAA Security Awareness and Training Number: TD-QMP-P-7011 Subject: Security Awareness and Training Primary Department: TennDent Effective Date of Procedure: 9/23/2011 Secondary

More information

Information Technology Security Policy for IBTS

Information Technology Security Policy for IBTS Information Technology Security Policy for IBTS Pakistan Stock Exchange Limited Table of contents Information Technology Security Policy for IBTS 1- INTRODUCTION AND SCOPE... 3 2- CHARTER OF THE DOCUMENT...

More information

SUPPLIER SECURITY STANDARD

SUPPLIER SECURITY STANDARD SUPPLIER SECURITY STANDARD OWNER: LEVEL 3 COMMUNICATIONS AUTHOR: LEVEL 3 GLOBAL SECURITY AUTHORIZER: DALE DREW, CSO CURRENT RELEASE: 12/09/2014 Purpose: The purpose of this Level 3 Supplier Security Standard

More information

Department of Public Safety and Correctional Services Information Technology and Communications Division

Department of Public Safety and Correctional Services Information Technology and Communications Division Audit Report Department of Public Safety and Correctional Services Information Technology and Communications Division March 2008 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND

More information

RAYSAFE S1 SECURITY WHITEPAPER VERSION B. RaySafe S1 SECURITY WHITEPAPER

RAYSAFE S1 SECURITY WHITEPAPER VERSION B. RaySafe S1 SECURITY WHITEPAPER RaySafe S1 SECURITY WHITEPAPER Contents 1. INTRODUCTION 2 ARCHITECTURE OVERVIEW 2.1 Structure 3 SECURITY ASPECTS 3.1 Security Aspects for RaySafe S1 Data Collector 3.2 Security Aspects for RaySafe S1 cloud-based

More information

MCR Checklist for Automated Information Systems (Major Applications and General Support Systems)

MCR Checklist for Automated Information Systems (Major Applications and General Support Systems) MCR Checklist for Automated Information Systems (Major Applications and General Support Systems) Name of GSS or MA being reviewed: Region/Office of GSS or MA being reviewed: System Owner: System Manager:

More information

Ferris State University

Ferris State University Ferris State University BUSINESS POLICY TO: All Members of the University Community 2009:08 DATE: May 2009 I. BACKGROUND IDENTITY THEFT PREVENTION PROGRAM The risk to the University, and its students,

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information