R W Social Security Numbers (SSNs): UNM ID Numbers (Banner IDs): Patient Name: Patient DOB: Patient Address: Patient Payroll/Financial Information: Patient Grades/ Advisement or Tutoring Records: Patient Health Information (MRN, Prescriptions, Patient Care/ Information: Patient Credit Card Information: (Please specify) Number of Records R W < 500 records created per year? 500 or more total records created per year? Location of Data Use R W Globally: UNMH/HSC Campus Only: Department or Specific Staff Only, Other: (Please specify) Agreement Do you have a sample vendor contract and/or statement of work? V No: Yes, please attach: BAA
W complexity failed logins lockouts, password history and other security measures available in the system: Can your system utilize passwords-This is the UNMH Standard R How will passwords be changed? Data Integrity How do you ensure the confidentiality, integrity, and availability of information collected and utilized by this system? V W Confidentiality: Integrity: Availability: Data Encryption To ensure compliance, endpoint devices and confidential data in motion and at rest must be encrypted to a recommended standard (AES 256, TLS1.1). NIST Standards. V W Can the system be encrypted with MacAfee encryption software? Will data at rest be encrypted? What algorithm is used? Will data in motion be encrypted? What algorithm is used? Security Logging and Monitoring V W What type of logs does the system create/transmit? (Syslog and specialized logs.) V W Does your system create and retain system audit logs and records to the extent needed to enable the monitoring, Yes No Explain
V Is McAfee AV compatible with your system, if not, what AV products do you support? OS and Vendor Applications Patching Wo is responsible for patching UNMH or vendor? R What is your patching policy/procedure? How often are application patches applied? How often are OS patches applied? V W Please specify Department or IT unit responsible for OS patching? Please specify Department or IT unit responsible for application patching? V W Please specify if your product(s) have any current vulnerabilities or have any listed CVE’s on the MITRE site: Third-party Applications & Patching V W What is your 3rd party patching policy/procedure? (This includes Adobe, browser plugins, etc.) How often are 3rd party patches applied? V W How do you test patches/updates for malicious code before the patches/updates are deployed to UNMH/Vendor systems?
V W Do you and/or can you utilize multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete? Yes No Explain R Please specify Department or IT unit responsible for 3rd party patching? Incident Response Components V W Which organization is the primary interface for security incidents, or other incidents to the system? V W When an incident involving UNMH EPHI data is detected, when is UNMH Notified? Frequency of IR Notifications? V W All SAAS vendors must provide UNMH a SAS70 ISO 270001 report related to their implementation/deployment of their security controls related to their organization and their IAAS/PAAS vendor (s) (Listing of their policies/procedures) Can you supply this report?
External (Internet Facing) If yes, there are significantly more threats that may exploit any vulnerabilities found in plan. Internal (e.g. Accidental: user or privileged user makes mistakes affecting data integrity). Are controls in place to mitigate vulnerabilities found that could come from internal network or accidental mistakes? Risk Score Matrix Impact Low Medium High Likelihood Low 1 2 3 Medium 2 4 6 High 3 6 9 Very high 4 8 12 Note 1: When calculating risk use the above numbers for assigning risk totals: 1-3 risk is Low, Yellow 4 risk is Medium and Red 6-12 risk is High. Note 2: When the ePHI data fields used, the impact is medium (2) if it ”will not result in loss of ePHI or PII in excess of 500 record and the impact is high if it “may result in loss of ePHI or PII in excess of 500 records”. If the likelihood is low (1) or medium (2). Medium impact (2) × Medium Likelihood (2) = (4) Medium Risk. Review the Likelihood ratings related to vulnerabilities found and Mitigations that can be used to reduce the likelihood and Impact. Definition: Risk is the combination of Probability-likelihood of and its consequences-impact (Impact is calculated first using Table 2. Then the probability-likelihood is calculated from Table 4). Impact * Likelihood = Risk for each threat or vulnerability the above plan. Security Analyst Name: Risk Scoring: