compliance Controls

Perform periodic technical and non-technical evaluations of security controls in response to environmental or operational changes

Implement reasonable and appropriate policies and procedures to comply with the HIPAA Security Rule

Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered

Legal, regulatory, and contractual requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed

A cybersecurity risk management policy is established and enforced

The cybersecurity policy is reviewed and updated to reflect changes in requirements, threats, and technology

Security controls are evaluated on an ongoing basis