| Trustmark Definition Name | Version |
|---|---|
|
Defines conformance and assessment criteria for verifying that an organization partitions the information system into organization-defined information system components residing in separate physical domains or environments based on organization-defined circumstances for physical separation of components.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization protects backup and restoration hardware, firmware, and software.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization provides the capability to restore information system components within a defined restoration time-periods from configuration-controlled and integrity-protected information representing a known, operational state for the components.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an information system implements transaction recovery for systems that are transaction-based.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system risk assessment implementation as related to overall risk assessment requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system risk assessment results reviewed as related to overall risk assessment requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system risk assessment updates as related to overall risk assessment requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system security categorization review and approval as related to overall risk assessment requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system user documentation - methods of secure user interaction as related to overall system and services acquisition requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system user documentation - user security functions as related to overall system and services acquisition requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for information system user documentation - user security responsibilities as related to overall system and services acquisition requirements.
|
1.0 |
|
Addresses the requirement for an organization to account for which subscriber had control of the private key for a group PKI certificate at a given time.
|
1.0 |
|
Addresses requirements for ensuring control of the private keys for group PKI certificates.
|
1.0 |
|
Addresses requirements for an organization to maintain a list of subscribers who have access to use of the private key for group PKI certificates.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for initial authenticator content as related to overall identification and authentication requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for initial basic security awareness training as related to overall awareness and training requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for initial contingency planning training as related to overall contingency planning requirements.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for initial incident response training as related to overall incident response requirements.
|
1.0 |
|
Addresses the requirement for organizations to require subscribers go through the initial registration process after a certificate has been revoked.
|
1.0 |
|
Defines conformance and assessment criteria for compliance with minimum security requirements for initial role-based security training as related to overall awareness and training requirements.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization restricts information input to any connection to services processing sensitive information to only authorized personnel.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization implements an insider threat program.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization's insider threat program includes a cross-discipline insider threat incident handling team.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.
|
1.0 |
|
Specifies that a health care related organization must have policies to protect electronic protected health information from improper alteration or destruction and must have policies for electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.
|
1.0 |
