Control	Category	Description
✓	Customer Data Deletion Upon Termination	Product	Customer data is securely deleted when no longer needed or upon contract termination in accordance with data retention policies.
✓	Data Classification	Product	Data is classified by sensitivity and handled accordingly to ensure appropriate levels of protection.
✓	Designated Security Officials	Organizational	BenOsphere has implemented and verified control for: Designated Security Officials.
✓	Contractor Requirements	Organizational	BenOsphere has implemented and verified control for: Contractor Requirements.
✓	Credential Keys Managed	Infrastructure	BenOsphere has implemented and verified control for: Credential Keys Managed.
✓	Cryptography Policies	Infrastructure	BenOsphere has implemented and verified control for: Cryptography Policies.
✓	System Access Granted	Infrastructure	System access is managed using a role-based model and is revoked immediately upon employee or contractor termination.
✓	Terminated Employee Access Revoked Within One Business Day	Infrastructure	System access is managed using a role-based model and is revoked immediately upon employee or contractor termination.
✓	Unique Accounts Used	Infrastructure	BenOsphere has implemented and verified control for: Unique Accounts Used.
✓	Unique SSH	Infrastructure	Public SSH access is disabled. Only authenticated and authorized users with unique credentials can access systems via secure protocols.
✓	Users Can Access All Their Information	Product	Each user is provisioned with a unique account. Access is monitored and governed by least privilege principles.
✓	Users Can Update their Information	Product	Users can view and update their information through a secure, authenticated interface in compliance with data accuracy standards.
✓	VPN Required for Production Access	Infrastructure	Production systems are only accessible through a secure VPN to protect internal assets from unauthorized external access.
✓	Vulnerability Management	Infrastructure	BenOsphere has implemented and verified control for: Vulnerability Management.
✓	Inactivity and Browser Exit Logout	Product	System activity and security events are logged centrally and monitored for suspicious behavior with real-time alerts.
✓	Least-Privileged Policy for Customer Data Access	Product	A formal Least-Privileged Policy for Customer Data Access is in place to govern consistent and secure operations across the organization.
✓	Log Management System	Infrastructure	System activity and security events are logged centrally and monitored for suspicious behavior with real-time alerts.
✓	Logging/Monitoring	Infrastructure	System activity and security events are logged centrally and monitored for suspicious behavior with real-time alerts.
✓	Logs Centrally Stored	Infrastructure	System activity and security events are logged centrally and monitored for suspicious behavior with real-time alerts.
✓	Malware Detection Software Installed	Infrastructure	BenOsphere has implemented and verified control for: Malware Detection Software Installed.
✓	Multiple Availability Zones	Infrastructure	BenOsphere has implemented and verified control for: Multiple Availability Zones.
✓	Network segmentation in place	Infrastructure	BenOsphere has implemented and verified control for: Network segmentation in place.
✓	Operational Audit	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Oversight of Security Controls	Organizational	BenOsphere has implemented and verified control for: Oversight of Security Controls.
✓	Password Manager	Infrastructure	BenOsphere has implemented and verified control for: Password Manager.
✓	Password Policy	Organizational	A formal Password Policy is in place to govern consistent and secure operations across the organization.
✓	Password Storage	Infrastructure	BenOsphere has implemented and verified control for: Password Storage.
✓	Removable Media Device Encryption	Infrastructure	Data is encrypted both at rest and in transit using industry-standard protocols. Encryption keys are tightly controlled and accessible only to authorized personnel.
✓	Require Authentication for Access	Product	System access is managed using a role-based model and is revoked immediately upon employee or contractor termination.
✓	Require Encryption of Web-Based Admin Access	Infrastructure	Data is encrypted both at rest and in transit using industry-standard protocols. Encryption keys are tightly controlled and accessible only to authorized personnel.
✓	Role-Based Security Implementation	Product	BenOsphere has implemented and verified control for: Role-Based Security Implementation.
✓	Servers Monitored and Alarmed	Infrastructure	Critical infrastructure components are continuously monitored with alerts configured for anomalous behavior or system failures.
✓	Session Lock	Infrastructure	BenOsphere has implemented and verified control for: Session Lock.
✓	SSL/TLS Enforced	Infrastructure	BenOsphere has implemented and verified control for: SSL/TLS Enforced.
✓	Activity Review	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Annual Access Control Review	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Annual Incident Response Test	Organizational	A comprehensive incident response plan exists and is tested annually to ensure swift action during security events.
✓	Annual Penetration Tests	Organizational	BenOsphere has implemented and verified control for: Annual Penetration Tests.
✓	Architectural Diagram	Infrastructure	BenOsphere has implemented and verified control for: Architectural Diagram.
✓	Authentication Protocol	Infrastructure	BenOsphere has implemented and verified control for: Authentication Protocol.
✓	Backup Integrity and Completeness	Infrastructure	Regular, automated backups are performed with integrity checks and monitored for successful completion to ensure recoverability in case of data loss.
✓	Backup Policy	Organizational	Regular, automated backups are performed with integrity checks and monitored for successful completion to ensure recoverability in case of data loss.
✓	Customer Data is Encrypted at Rest	Product	BenOsphere has implemented and verified control for: Customer Data is Encrypted at Rest.
✓	Customer Data Policies	Organizational	BenOsphere has implemented and verified control for: Customer Data Policies.
✓	Daily Backup Statuses Monitored	Infrastructure	Regular, automated backups are performed with integrity checks and monitored for successful completion to ensure recoverability in case of data loss.
✓	Data Destruction Policy	Organizational	A formal Data Destruction Policy is in place to govern consistent and secure operations across the organization.
✓	Data Retention Policy	Organizational	A formal Data Retention Policy is in place to govern consistent and secure operations across the organization.
✓	Database Monitored and Alarmed	Infrastructure	Critical infrastructure components are continuously monitored with alerts configured for anomalous behavior or system failures.
✓	Denial of Public SSH	Infrastructure	Public SSH access is disabled. Only authenticated and authorized users with unique credentials can access systems via secure protocols.
✓	Disaster Recovery Plan	Organizational	Business continuity and disaster recovery plans are in place to minimize disruption during unforeseen incidents.
✓	Disposal of Sensitive Data on Hardware	Infrastructure	BenOsphere has implemented and verified control for: Disposal of Sensitive Data on Hardware.
✓	Disposal of Sensitive Data on Paper	Infrastructure	BenOsphere has implemented and verified control for: Disposal of Sensitive Data on Paper.
✓	Encryption Policy	Organizational	Data is encrypted both at rest and in transit using industry-standard protocols. Encryption keys are tightly controlled and accessible only to authorized personnel.
✓	Event Logging	Infrastructure	System activity and security events are logged centrally and monitored for suspicious behavior with real-time alerts.
✓	Failed Backup Alert and Action	Infrastructure	Regular, automated backups are performed with integrity checks and monitored for successful completion to ensure recoverability in case of data loss.
✓	FIM (File Integrity Monitoring) Software in Place	Infrastructure	Critical infrastructure components are continuously monitored with alerts configured for anomalous behavior or system failures.
✓	Hard-Disk Encryption	Infrastructure	Data is encrypted both at rest and in transit using industry-standard protocols. Encryption keys are tightly controlled and accessible only to authorized personnel.
✓	Hardening Standards in Place	Infrastructure	BenOsphere has implemented and verified control for: Hardening Standards in Place.
✓	Document Retention Period	Organizational	Data retention is governed by clearly defined policies ensuring legal and operational requirements are met.
✓	Employee Disclosure Process	Organizational	BenOsphere has implemented and verified control for: Employee Disclosure Process.
✓	Follow-Ups Tracked	Organizational	BenOsphere has implemented and verified control for: Follow-Ups Tracked.
✓	HIPAA Awareness Training	Organizational	All employees and contractors complete regular HIPAA and cybersecurity training to ensure awareness of responsibilities and threats.
✓	Incident Response Team	Organizational	A comprehensive incident response plan exists and is tested annually to ensure swift action during security events.
✓	Incident Response Plan	Organizational	A comprehensive incident response plan exists and is tested annually to ensure swift action during security events.
✓	Termination/Offboarding Checklist	Organizational	BenOsphere has implemented and verified control for: Termination/Offboarding Checklist.
✓	3rd Parties and Vendors Given Instructions on Breach Reporting	Organizational	Vendors are assessed for compliance, and agreements are maintained to ensure they meet BenOsphere’s security and privacy standards.
✓	Acceptable Use Policy Employees Acknowledge	Organizational	A formal Acceptable Use Policy Employees Acknowledge is in place to govern consistent and secure operations across the organization.
✓	Allowable Use and Disclosure	Organizational	BenOsphere has implemented and verified control for: Allowable Use and Disclosure.
✓	Annual Review of Purposes	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Asset Management Policy	Organizational	A formal Asset Management Policy is in place to govern consistent and secure operations across the organization.
✓	Background Checks	Organizational	BenOsphere has implemented and verified control for: Background Checks.
✓	Business Associate Agreements	Organizational	BenOsphere has implemented and verified control for: Business Associate Agreements.
✓	Business Continuity Plan	Organizational	Business continuity and disaster recovery plans are in place to minimize disruption during unforeseen incidents.
✓	Business Impact Analysis	Organizational	BenOsphere has implemented and verified control for: Business Impact Analysis.
✓	Breach Notification	Organizational	BenOsphere has implemented and verified control for: Breach Notification.
✓	Board Oversight Briefings Conducted	Organizational	BenOsphere has implemented and verified control for: Board Oversight Briefings Conducted.
✓	Code of Conduct	Organizational	BenOsphere has implemented and verified control for: Code of Conduct.
✓	Commitments Explained to Customers	Product	BenOsphere has implemented and verified control for: Commitments Explained to Customers.
✓	Communication to 3rd Parties	Organizational	BenOsphere has implemented and verified control for: Communication to 3rd Parties.
✓	Conduct Control Self-Assessments	Organizational	BenOsphere has implemented and verified control for: Conduct Control Self-Assessments.
✓	Continuous Control Monitoring	Organizational	Critical infrastructure components are continuously monitored with alerts configured for anomalous behavior or system failures.
✓	Defined Management Roles & Responsibilities	Organizational	BenOsphere has implemented and verified control for: Defined Management Roles & Responsibilities.
✓	Data Protection Policy	Organizational	A formal Data Protection Policy is in place to govern consistent and secure operations across the organization.
✓	DLP (Data Loss Prevention) Software is Used	Infrastructure	BenOsphere has implemented and verified control for: DLP (Data Loss Prevention) Software is Used.
✓	Disclosure with 3rd Parties	Organizational	BenOsphere has implemented and verified control for: Disclosure with 3rd Parties.
✓	Disclosure Process for Customers	Organizational	BenOsphere has implemented and verified control for: Disclosure Process for Customers.
✓	Information Security Policy	Organizational	A formal Information Security Policy is in place to govern consistent and secure operations across the organization.
✓	Information Security Skills Matrix	Organizational	BenOsphere has implemented and verified control for: Information Security Skills Matrix.
✓	Maintains a Privacy Policy	Organizational	A formal Maintains a Privacy Policy is in place to govern consistent and secure operations across the organization.
✓	Maintains Asset Inventory	Organizational	BenOsphere has implemented and verified control for: Maintains Asset Inventory.
✓	Messaging Queues Monitored and Alarmed	Infrastructure	Critical infrastructure components are continuously monitored with alerts configured for anomalous behavior or system failures.
✓	Notice of Breach to Affected Users	Organizational	Each user is provisioned with a unique account. Access is monitored and governed by least privilege principles.
✓	PII with 3rd Parties and Vendors	Organizational	Vendors are assessed for compliance, and agreements are maintained to ensure they meet BenOsphere’s security and privacy standards.
✓	Privacy Policy Includes 3rd Party Vendors	Organizational	A formal Privacy Policy Includes 3rd Party Vendors is in place to govern consistent and secure operations across the organization.
✓	Privacy Policy Publicly Available	Organizational	A formal Privacy Policy Publicly Available is in place to govern consistent and secure operations across the organization.
✓	Privacy, Use, and Disclosure	Organizational	BenOsphere has implemented and verified control for: Privacy, Use, and Disclosure.
✓	Provide Notice of Privacy Practices	Organizational	BenOsphere has implemented and verified control for: Provide Notice of Privacy Practices.
✓	Quarterly Review of Privacy Compliance	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Remediation Plan	Organizational	BenOsphere has implemented and verified control for: Remediation Plan.
✓	Review Privacy Notice Annually	Organizational	Security controls and data access are reviewed regularly to maintain regulatory compliance and identify improvement opportunities.
✓	Risk Assessment Policy	Organizational	A formal Risk Assessment Policy is in place to govern consistent and secure operations across the organization.
✓	Security Team Communicates in a Timely Manner	Organizational	A dedicated security team oversees compliance efforts and ensures accountability at the organizational level.
✓	Security Team/Steering Committee	Organizational	A dedicated security team oversees compliance efforts and ensures accountability at the organizational level.
✓	Security Training	Organizational	All employees and contractors complete regular HIPAA and cybersecurity training to ensure awareness of responsibilities and threats.
✓	Security Updates	Infrastructure	BenOsphere has implemented and verified control for: Security Updates.
✓	Software Development Life Cycle Policy	Organizational	A formal Software Development Life Cycle Policy is in place to govern consistent and secure operations across the organization.
✓	Storage of Sensitive Data on Paper	Organizational	BenOsphere has implemented and verified control for: Storage of Sensitive Data on Paper.
✓	System Access Control Policy	Organizational	A formal System Access Control Policy is in place to govern consistent and secure operations across the organization.
✓	Unauthorized Disclosures by 3rd Parties	Organizational	BenOsphere has implemented and verified control for: Unauthorized Disclosures by 3rd Parties.
✓	Vendor Agreements Maintained	Organizational	Vendors are assessed for compliance, and agreements are maintained to ensure they meet BenOsphere’s security and privacy standards.
✓	Vendor Compliance Reports	Organizational	Vendors are assessed for compliance, and agreements are maintained to ensure they meet BenOsphere’s security and privacy standards.
✓	Vendor Management Policy	Organizational	A formal Vendor Management Policy is in place to govern consistent and secure operations across the organization.
✓	Vendors and PHI	Organizational	Vendors are assessed for compliance, and agreements are maintained to ensure they meet BenOsphere’s security and privacy standards.
✓	Annual Risk Assessment	Organizational	BenOsphere has implemented and verified control for: Annual Risk Assessment.
✓	Intrusion Detection System in Place	Infrastructure	BenOsphere has implemented and verified control for: Intrusion Detection System in Place.