Technology Source Enterprise & Compliance 

Assessment Includes:

INCLUDES THE BUSINESS ASSESSMENT PLUS ONE OF THE FOLLOWING:​

• ENTERPRISE ASSESSMENT

• HIPAA ASSESSMENT

• GDPR ASSESSMENT

• CMMC OR NIST ASSESSMENT

• PCI ASSESSMENT

​

• Installation and configuration of agentless, non-intrusive software

• One time scan of network

• Generation of forms with information needed from customer to complete the assessment

• Client Risk Report with overall risk score and list of problem areas

• Network Management Plan with affected computers, users, and sub-systems sorted according to risk

• Asset Detail Report listing individual assets discovered and documenting settings of workstations and servers

• Security Risk Report showing overall relative health of network security

• Security Management Plan with list of security risks and recommendations

• Anomalous Login Report listing potential unauthorized users or unusual usage instances

• External Vulnerabilities Scan Report listing

​

Technology Source HIPAA Assessment Includes:

• Install and configure agentless, non-intrusive scanning software

• Run quarterly scan of customer’s network

• Generate To-Do List of assessment tasks to be completed

• Provide customer access to compliance portal with centralized access to list of tasks required to complete the assessment

• HIPAA Evidence of Compliance with information from automated scans and questionnaires

• HIPAA Policies and Procedures used to implement ePHI data security and compliance

• HIPAA Risk Analysis Report identifying protections in place and listing issues requiring remediation

• HIPAA Management Plan with tasks required to minimize, avoid, or respond to risks

• HIPAA Security Rule Auditor Checklist with specific compliance items, their status, and helpful references

• HIPAA On-Site Survey to assist security officer in assessing physical security outside the computer network

• HIPAA External Vulnerability Scan showing CVSS scores as scanned from outside the network

​

Technology Source GDPR Assessment Includes:

• Install and configure agentless, non-intrusive scanning software

• Run quarterly scan of customer’s network

• GDPR Checklist with list of specific compliance items and helpful references

• ISO 27001-2013 Auditor Checklist with overview of how well the organization complies with ISO 27001-2013

• EU GDPR Policies and Procedures documenting personal data security and compliance with GDPR

• ISO 27001-2013 Policies and Procedures demonstrating technical compliance with information security aspects of GDPR

• Risk Treatment Plan with tasks required to minimize, avoid, or respond to risks

• GDPR Evidence of Compliance with consolidated information from automated scans, augmented data, and questionnaires

​

Technology Source CMMC/NIST Assessment Includes:

• Install and configure agentless, non-intrusive scanning software

• Run quarterly scan of customer’s network

• NIST Auditor Checklist detailing specific compliance findings from the scan with helpful references

• NIST Risk Treatment Plan defines the strategies and tactics the organization will use to address its risks

• NIST Risk Analysis identifies what protections are in place and where there is a need for more

• Evidence of NIST Compliance report gathers evidence into one document to back up the NIST Auditor Checklist with real data

​

Technology Source PCI Assessment Includes:

• Install and configure agentless, non-intrusive scanning software

• Run one time scan of customer’s network

• Generate forms with information needed from customer to complete the assessment

• PCI Evidence of Compliance with information from automated scans and questionnaires

• PCI Policies and Procedures used to comply with the technical requirements of PCI, usually the first document request by the PCI examiner

• PCI Risk Analysis Report, a list of issues to remediate to ensure the security and confidentiality of Cardholder Data

• PCI Management Plan listing prioritized tasks, by Risk Score

• External Vulnerability Scan showing security holes and warnings, and informational items including CVSS scores as scanned from outside the target network