Employees are required to complete security awareness training within 30 days of being hired and at least once a year thereafter.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

Senior management briefs the board of directors, or an appropriate subcommittee, at least once a year on the company’s cybersecurity and privacy risk posture. The board offers guidance and feedback to management as necessary.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company’s information security policies and procedures are formally documented and reviewed at least once a year.

The company uses secure transmission protocols to encrypt confidential and sensitive data when it is transmitted over public networks.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company requires passwords for in-scope system components to be configured in accordance with its policy.

The company encrypts datastores containing sensitive customer data at rest.

The company installs critical security patches within one month of their release, as determined by the risk ranking process defined in VPM-4.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company performs access reviews at least quarterly for in-scope system components to ensure access is appropriately restricted. Required changes are tracked to completion.

The company restricts remote access to production systems to authorized employees using an approved encrypted connection.

The company reviews data center access at least once a year.

The company has implemented procedures to guard against, detect, and report malicious software.

The company uses an intrusion detection system to continuously monitor its network and detect potential security breaches early.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company’s formal policies define requirements for the following IT and engineering functions: 1. Vulnerability management 2. System monitoring

The company maintains a process for identifying security vulnerabilities that includes: 1. Using reputable external sources to obtain current vulnerability information 2. Assigning risk rankings to identified vulnerabilities, clearly highlighting all high-risk and critical issues Risk rankings follow industry best practices and consider factors such as CVSS base scores, vendor classifications, and the affected system types. The risk assessment strategy ensures that all high-risk vulnerabilities are identified and that critical vulnerabilities, including those impacting public-facing systems, security infrastructure, or systems processing cardholder data, are addressed promptly.

The company’s security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management in accordance with its security incident response policy and procedures.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company restricts production change migrations to authorized personnel only.

The company has a formal systems development life cycle (SDLC) methodology that governs the development, acquisition, implementation, maintenance, and changes (including emergency changes) of information systems and related technology requirements.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

For service providers, the company performs reviews at least quarterly to confirm personnel comply with security policies and operational procedures.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The company uses an infrastructure monitoring tool to track systems, infrastructure, and performance, generating alerts when predefined thresholds are reached.

The company employs a multi-location strategy for production environments to enable operations to resume at alternate data centers if a facility becomes unavailable.

The company’s databases are replicated in real time to a secondary data center, with alerts set up to notify administrators of any replication failures.

The company has established and implements, as needed, policies and procedures for responding to emergencies or other events (such as fire, vandalism, system failure, or natural disaster) that may damage systems containing electronic Protected Health Information (ePHI).

The company uses environmental monitoring devices configured to automatically alert management in the event of environmental incidents.

The company encrypts datastores containing sensitive customer data at rest.

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

The company performs periodic backups of production data, storing the backups in a separate location from the production environment.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

The company’s system evaluates data inputs for compliance with input requirements and generates on-screen alerts when issues with transaction inputs or processing are detected.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To establish efficient governance for PII processing.

The organization identifies and documents the specific purposes for which personally identifiable information is processed.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes a mechanism that enables individuals to modify or withdraw their consent for the processing of their personally identifiable information.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

To minimize the PII which is processed to what is strictly necessary for the legitimate interest pursued by the PII controller and to limit the disclosure of PII to a minimum number of internal and external parties.

The organization obtains and records consent from personally identifiable information principals in accordance with documented processes.

The organization establishes and documents a process that enables it to demonstrate whether, when, and how consent for the processing of personally identifiable information (PII) was obtained from PII principals.

To retain PII no longer than necessary to fulfill the stated purpose(s) or to abide by applicable laws.

Personal data shall not be disclosed, made available, or otherwise used for purposes other than those specified, except: a) With the consent of the data subject, or b) By the authority of law

The organization securely disposes of data in accordance with the documented data management process, ensuring that disposal methods are appropriate for the sensitivity of the data.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

The organization identifies and documents applicable legal, regulatory, and business obligations owed to individuals regarding the processing of their personally identifiable information and establishes measures to fulfill those obligations.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The organization provides customers with mechanisms or support necessary to enable them to meet obligations owed to individuals regarding the processing of personally identifiable information.

The company has a vendor management program in place that includes: 1. Critical third-party vendor inventory 2. Vendor security and privacy requirements 3. Review of critical third-party vendors at least annually

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

To make data subjects active participants in the decision-making process regarding the processing of their PII, except as otherwise limited by legislation and regulations, through the exercise of meaningful, informed and freely given consent.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.

To limit the use and disclosure of PII for specific, explicit and legitimate purposes and to fulfill the stated purpose(s) or to abide by applicable laws.

The company provides requested information, after verification, in a timely manner either in a portable electronic format or by mail, in compliance with applicable law.

To give data subjects the ability to access and review their PII and to challenge its accuracy and completeness.

The company maintains written agreements with vendors and third parties, which include applicable confidentiality and privacy commitments.

The company retains customer transaction data for the duration of the customer account. Historical transaction data is not purged until the account is deleted.

To ensure, through contractual or other means, that third party recipients provide at least equivalent levels of PII protection.

The organization establishes and maintains a documented data management process that addresses, at a minimum: 1. Data sensitivity 2. Data owner 3. Data handling 4. Data retention limits 5. Data disposal requirements The organization aligns these elements with enterprise sensitivity and retention standards and reviews and updates the documentation annually or upon significant changes that could impact this control.

The company has implemented policies and procedures to safeguard electronic Protected Health Information (ePHI) against unauthorized alteration or destruction.

A data controller shall be accountable for implementing and complying with the measures that give effect to the principles set forth in this framework.

The organization establishes and documents policies and procedures for receiving, handling, and responding to legitimate requests from individuals regarding the processing of their personally identifiable information.