1. To which of the following items of personal information do you have access (collect, store, transmit, view, etc.)? Please check all that apply
Please list any previously unmentioned personal information items to which you have access (separate by commas). If there are no more, please leave blank.
2. Select one of the following which most closely describes your company's access to personal information:
3. Name the formally designated person or position that serves as your organization's privacy and security officer, or otherwise has assigned responsibility for privacy and security. If none, leave blank.
4. When was the last time you updated your documented privacy and information security policies and procedures?
5. Describe how the privacy and information security policies and procedures are communicated to all personnel, and made available for them to review at any time. Check all that apply.
6. Do you provide both regular training and ongoing awareness communications for information security and privacy for all your workers?
7. When was the most recent information security and privacy training provided?
8. When was the most recent information security risk assessment performed? NOTE: This high level security assessment you are currently taking is NOT a full, comprehensive security risk assessment, so do not count this as your most recent security risk assessment.
9. When was the last time you performed a vulnerability or penetration scan on your networks and systems? NOTE: These are typically automated scans, and are not the same as a full security risk assessment
10. Do you require all types of sensitive information, including personal information and health information, to be encrypted when it is sent through public networks and when it is stored on mobile computers and mobile storage devices?
11. Do you require information, in all forms, to be disposed of using secure methods?
12. Do you have a documented security event monitoring, security incident plan, and breach response and notification plan, and teams or staff to support the plan?
13. External Parties: Do you outsource any activities involving (personal information) or any other type of confidential information?
14. If yes to above, does your organization have security agreements in place with each of these third parties? NOTE: These are often included as addendums to, or within security and privacy clauses within, your service contracts with them.
15. Do you follow a process to identify new data protection legal requirements? (e.g., new state breach notification requirements , updates to data protection regulations, etc.)?
16. Check all the following standards and regulations for which you can verify compliance:
17. Does your organization perform background checks to examine and assess a potential, or current, employee's and contractor's work and criminal history?
18. Are your employees required to sign a non-disclosure agreement upon hire, and then again annually?
19. Do you have a formal process to manage the termination and or transfer of employees?
20. Do you have physical security controls (e.g., door locks, building alarms, security cameras, etc.) to prevent unauthorized access to facilities, a facility security plan, and physical controls on mobile computing devices?
21. Do you have controls on systems and networks that host, process and / or transfer personal information and other types of sensitive information, including the use of firewalls and controls for protecting network devices from unauthorized access and data-theft?
22. Are connections to your networks and systems logged and monitored?
23. Do you have a formal access authorization process based on 'least privilege' (employees are granted the least amount of access to information and systems possible in order to perform their assigned duties) and need to know (access permissions are granted based upon the legitimate business need of the user to access the information)?
24. Do you require each user ID to be unique and not shared with others, and have a process to disable and remove the IDs when the user leaves the organization?
25. Have you implemented anti-malware (e.g., anti-virus, spam filters, etc.) software on your computers and supporting systems?
26. Media handling: Do procedures exist to protect documents (e.g., paper files, prescription labels, print materials, etc.) and computer media (e.g., tapes, disks, CD-ROMs, etc.), from unauthorized disclosure, modification, removal, and destruction? Is sensitive data encrypted when stored on laptop, desktop and server hard drives, flash drives, backup tapes, etc. ? If the answer is "No" to either of these questions, answer "No".
27. Segregation of Computing Environments: Are development, test and production environments separated from operational IT environments to protect production (actively used) applications from inadvertent changes or disruption? Are the data files of your business clients segregated from one another? If the answer to either question is "No" indicate "No" as your answer. Or, is this not applicable at your organization?
28. Segregation of Duties: Are duties separated, where appropriate, to reduce the opportunity for unauthorized modification, unintentional modification or misuse of the organization's IT assets? Or, is this not applicable at your organization?
29. Change Management: Do formal change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability (e.g., virus or spyware) patching activities? Or, is this not applicable at your organization?
30. How would you evaluate your current implementation of all of the above controls?
31. Could you provide documentation (e.g., information security policies, supporting business documentation, etc.) for all the controls above within 24 hours or request?
