Compliancemanzill.com
HITRUST

Compliance assessment

HITRUST

156 controls in 18 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at 00.a

Information Security Management Program1

00.aInformation Security Management ProgramNot assessed

Access Control8

01.aAccess Control PolicyNot assessed01.bUser RegistrationNot assessed01.cPrivilege ManagementNot assessed01.dUser Password ManagementNot assessed01.eReview of User Access RightsNot assessed01.fPassword UseNot assessed01.gUnattended User EquipmentNot assessed01.hClear Desk and Clear Screen PolicyNot assessed

Network Access Control7

01.iPolicy on the use of network servicesNot assessed01.jUser Authentication for External ConnectionsNot assessed01.kEquipment Identification in NetworksNot assessed01.lRemote Diagnostic and Configuration Port ProtectionNot assessed01.mSegregation in NetworksNot assessed01.nNetwork Connection ControlNot assessed01.oNetwork Routing ControlNot assessed

Operating System Access Control6

01.pSecure Log-On ProceduresNot assessed01.qUser Identification and AuthenticationNot assessed01.rPassword Management SystemNot assessed01.sUse of System UtilitiesNot assessed01.tSession Time-outNot assessed01.uLimitation of Connection TimeNot assessed

Application and Information Access Control2

01.vInformation Access RestrictionNot assessed01.wSensitive System IsolationNot assessed

Mobile Computing and Teleworking2

01.xMobile Computing and CommunicationsNot assessed01.yTeleworkingNot assessed

Human Resources Security9

02.aRoles and ResponsibilitiesNot assessed02.bScreeningNot assessed02.cTerms and Conditions of EmploymentNot assessed02.dManagement ResponsibilitiesNot assessed02.eInformation Security Awareness, Education, and TrainingNot assessed02.fDisciplinary ProcessNot assessed02.gTermination or Change ResponsibilitiesNot assessed02.hReturn of AssetsNot assessed02.iRemoval of Access RightsNot assessed

Risk Management4

03.aRisk Management Program DevelopmentNot assessed03.bPerforming Risk AssessmentsNot assessed03.cRisk MitigationNot assessed03.dRisk EvaluationNot assessed

Security Policy2

04.aInformation Security Policy DocumentNot assessed04.bReview of the Information Security PolicyNot assessed

Organization of Information Security8

05.aManagement Commitment to Information SecurityNot assessed05.bInformation Security CoordinationNot assessed05.cAllocation of Information Security ResponsibilitiesNot assessed05.dAuthorization Process for Information Assets and FacilitiesNot assessed05.eConfidentiality AgreementsNot assessed05.fContact with AuthoritiesNot assessed05.gContact with Special Interest GroupsNot assessed05.hIndependent Review of Information SecurityNot assessed

External Parties3

05.iIdentification of Risks Related to External PartiesNot assessed05.jAddressing Security When Dealing with CustomersNot assessed05.kAddressing Security in Third Party AgreementsNot assessed

Compliance10

06.aIdentification of Applicable LegislationNot assessed06.bIntellectual Property RightsNot assessed06.cProtection of Organizational RecordsNot assessed06.dData Protection and Privacy of Covered InformationNot assessed06.ePrevention of Misuse of Information AssetsNot assessed06.fRegulation of Cryptographic ControlsNot assessed06.gCompliance with Security Policies and StandardsNot assessed06.hTechnical Compliance CheckingNot assessed06.iInformation Systems Audit ControlsNot assessed06.jProtection of Information Systems Audit ToolsNot assessed

Asset Management5

07.aInventory of AssetsNot assessed07.bOwnership of AssetsNot assessed07.cAcceptable Use of AssetsNot assessed07.dClassification GuidelinesNot assessed07.eInformation Labeling and HandlingNot assessed

Physical and Environmental Security13

08.aPhysical Security PerimeterNot assessed08.bPhysical Entry ControlsNot assessed08.cSecuring Offices, Rooms, and FacilitiesNot assessed08.dProtecting Against External and Environmental ThreatsNot assessed08.eWorking in Secure AreasNot assessed08.fPublic Access, Delivery, and Loading AreasNot assessed08.gEquipment Siting and ProtectionNot assessed08.hSupporting UtilitiesNot assessed08.iCabling SecurityNot assessed08.jEquipment MaintenanceNot assessed08.kSecurity of Equipment Off-PremisesNot assessed08.lSecure Disposal or Re-Use of EquipmentNot assessed08.mRemoval of PropertyNot assessed

Communications and Operations Management32

09.aDocumented Operations ProceduresNot assessed09.aaAudit LoggingNot assessed09.abMonitoring System UseNot assessed09.acProtection of Log InformationNot assessed09.adAdministrator and Operator LogsNot assessed09.aeFault LoggingNot assessed09.afClock SynchronizationNot assessed09.bChange ManagementNot assessed09.cSegregation of DutiesNot assessed09.dSeparation of Development, Test, and Operational EnvironmentsNot assessed09.eService DeliveryNot assessed09.fMonitoring and Review of Third Party ServicesNot assessed09.gManaging Changes to Third Party ServicesNot assessed09.hCapacity ManagementNot assessed09.iSystem AcceptanceNot assessed09.jControls Against Malicious CodeNot assessed09.kControls Against Mobile CodeNot assessed09.lBack-upNot assessed09.mNetwork ControlsNot assessed09.nSecurity of Network ServicesNot assessed09.oManagement of Removable MediaNot assessed09.pDisposal of MediaNot assessed09.qInformation Handling ProceduresNot assessed09.rSecurity of System DocumentationNot assessed09.sInformation Exchange Policies and ProceduresNot assessed09.tExchange AgreementsNot assessed09.uPhysical Media in TransitNot assessed09.vElectronic MessagingNot assessed09.wInterconnected Business Information SystemsNot assessed09.xElectronic Commerce ServicesNot assessed09.yOn-line TransactionsNot assessed09.zPublicly Available InformationNot assessed

Information Systems Acquisition, Development, and Maintenance13

10.aSecurity Requirements Analysis and SpecificationNot assessed10.bInput Data ValidationNot assessed10.cControl of Internal ProcessingNot assessed10.dMessage IntegrityNot assessed10.eOutput Data ValidationNot assessed10.fPolicy on the Use of Cryptographic ControlsNot assessed10.gKey ManagementNot assessed10.hControl of Operational SoftwareNot assessed10.iProtection of System Test DataNot assessed10.jAccess Control to Program Source CodeNot assessed10.kChange Control ProceduresNot assessed10.lOutsourced Software DevelopmentNot assessed10.mControl of Technical VulnerabilitiesNot assessed

Information Security Incident Management5

11.aReporting Information Security EventsNot assessed11.bReporting Security WeaknessesNot assessed11.cResponsibilities and ProceduresNot assessed11.dLearning from Information Security IncidentsNot assessed11.eCollection of EvidenceNot assessed

Business Continuity Management26

12.aIncluding Information Security in the Business Continuity Management ProcessNot assessed12.bBusiness Continuity and Risk AssessmentNot assessed12.cDeveloping and Implementing Continuity Plans Including Information SecurityNot assessed12.dBusiness Continuity Planning FrameworkNot assessed12.eTesting, Maintaining and Re-Assessing Business Continuity PlansNot assessed13.aPrivacy NoticeNot assessed13.bOpenness and TransparencyNot assessed13.cAccounting of DisclosuresNot assessed13.dConsentNot assessed13.eChoiceNot assessed13.fPrinciple AccessNot assessed13.gPurpose LegitimacyNot assessed13.hPurpose SpecificationNot assessed13.iCollection LimitationNot assessed13.jData MinimizationNot assessed13.kUse and DisclosureNot assessed13.lRetention and DisposalNot assessed13.mAccuracy and QualityNot assessed13.nParticipation and RedressNot assessed13.oCompliant ManagementNot assessed13.pGovernanceNot assessed13.qPrivacy and Impact AssessmentNot assessed13.rPrivacy Requirements for Contractors and ProcessorsNot assessed13.sPrivacy Monitoring and AuditingNot assessed13.tPrivacy Protection Awareness and TrainingNot assessed13.uPrivacy Protection ReportingNot assessed