Are sufficient records kept for surveillance cameras (CCTV)? Facilities must maintain at least 30 consecutive days, 24/7 of CCTV records for all sensitive If No, please explain: areas. Information Technology Security Password Protection If yes, please identify the time frame in 12.27a Does your facility have automated systems which passwords are changed: for individually assigned accounts that require a periodic change of password? Please give a summary of your objective evidence If No, please explain: to support this question. Does your facility have documented IT security policies, procedures, and standards in place? Please give a summary of your objective evidence If No, please explain: to support this question. Are policies, procedures and standards provided to employees in the form of training? Please give a summary of your objective evidence If No, please explain: to support this question. Accountability 12.28a Does your facility have a system in place to identify the abuse of IT including improper access, tampering, or the altering of business data? Please give a summary of your objective evidence If No, please explain: to support this question. Are all system violators subject to appropriate disciplinary actions for abuse? Please give a summary of your objective evidence to support this question. If No, please explain:
Are sufficient records kept for surveillance cameras (CCTV)? Facilities must maintain at least 30 consecutive days, 24/7 of CCTV records for all sensitive areas. If No, please explain: Information Technology Security Password Protection 12.27a Does your facility have automated systems for individually assigned accounts that require a periodic change of password? Please give a summary of your objective evidence to support this question. If yes, please identify the time frame in which passwords are changed: If No, please explain: Does your facility have documented IT security policies, procedures, and standards in place? Please give a summary of your objective evidence to support this question. If No, please explain: Are policies, procedures and standards provided to employees in the form of training? Please give a summary of your objective evidence to support this question. If No, please explain: Accountability 12.28a Does your facility have a system in place to identify the abuse of IT including improper access, tampering, or the altering of business data? Please give a summary of your objective evidence to support this question. If No, please explain: Are all system violators subject to appropriate disciplinary actions for abuse? Please give a summary of your objective evidence to support this question. If No, please explain:
2018-07%20WRAP%20Pre-Audit%20Self-Assessment%20English%20Fillable%20Protected.docx