36 baseline controls across 6 frameworks

Documented and approved information security policies are established and maintained.

Access rights are provisioned based on business need and least privilege.

Security incidents are identified, escalated, and responded to through defined procedures.

Recovery and continuity planning ensure resilience during disruption.

Personnel receive security awareness and role-based training.

Measures are defined to prevent unauthorized disclosure or loss of sensitive information.

Leadership demonstrates commitment to integrity, ethics, and accountability.

Information required for control operation is communicated internally and externally.

Logical access controls restrict unauthorized access to systems and data.

Security events are detected, analyzed, and acted on in a timely manner.

Changes to infrastructure, systems, and applications are authorized, tested, and approved.

Third-party service providers are evaluated and monitored for risk.

Personal data is processed lawfully, fairly, transparently, and with minimization.

A valid lawful basis is documented for each data processing activity.

Processors are governed by contracts with mandatory privacy clauses.

Controllers/processors maintain records of processing activities.

Technical and organizational controls are in place to secure personal data.

Personal data breaches are reported to authorities and affected persons as required.

Organizational context, strategy, and risk priorities are documented.

Assets and data are inventoried, classified, and prioritized.

Identities are managed and access is controlled with least privilege.

Anomalies and cybersecurity events are continuously monitored and analyzed.

Incident response plans are documented, tested, and executed.

Recovery plans enable restoration of systems and services after incidents.

Implement risk analysis and risk management for ePHI.

Workforce access to ePHI is authorized and supervised.

Implement security awareness and training for workforce members.

Implement technical policies for access to electronic protected health information.

Record and examine activity in systems containing ePHI.

Business associates are bound by contractual safeguards for PHI.

Install and maintain network security controls to protect cardholder data.

Stored account data is protected with strong cryptography and minimization.

Develop and maintain secure systems and applications.

Access to system components and cardholder data is restricted by business need.

Log and monitor all access to system components and cardholder data.

Maintain an information security policy with risk management and incident response expectations.