Cybersecurity Policies

• Acceptable Use of Cone Health Information
  • Defines acceptable and prohibited use of organizational technology resources, systems, networks, and data.

• Azure Security
  • Establishes security requirements and baseline controls for protecting Microsoft Azure cloud services, workloads, and infrastructure.

• Application Security Requirement
  • Establishes minimum security requirements for the design, development, testing, deployment, and maintenance of applications.

• Cloud Security
  • Defines security requirements for the secure adoption, deployment, management, and monitoring of cloud-based systems and services.

• Cryptographic Protection
  • Establishes requirements for the use of encryption and cryptographic controls to protect sensitive information and communications.

• Data Protection
  • Establishes requirements for protecting sensitive, confidential, and regulated data throughout its lifecycle, including storage, transmission, retention, and disposal.

• Exception to IT and Information Security
  • Defines the process for requesting, reviewing, approving, documenting, and monitoring exceptions to established IT and security requirements.

• Information Security Governance and Organization
  • Defines the governance structure, roles, responsibilities, and oversight mechanisms for managing the organization’s information security program.

• Information Security Incident Management
  • Provides guidance for detecting, reporting, responding to, investigating, and recovering from information security incidents.

• Information Technology Risk Management
  • Establishes the framework for identifying, assessing, mitigating, monitoring, and reporting technology-related risks across the organization.

• IT Problem Management
  • Defines the process for identifying root causes of recurring IT incidents and implementing corrective actions to reduce operational disruptions.

• IT Resiliency Crisis Management and Business Continuity
  • Establishes requirements for maintaining critical operations during disruptions through business continuity, disaster recovery, and crisis management practices.

• IT Segregation of Duties
  • Defines controls to separate conflicting responsibilities and reduce the risk of unauthorized activities, fraud, or operational errors.

• ITS Data Backup and Recovery Procedure
  • This policy defines the requirements and procedures for backing up, protecting, and recovering organizational data and systems to ensure business continuity and timely restoration in the event of data loss, corruption, or system failure.

• Network Security
  • Defines security requirements for protecting network infrastructure, communications, and connected systems from unauthorized access and cyber threats.

• Premises Information Security and Privacy
  • Establishes physical security and privacy controls for protecting facilities, personnel, information assets, and operational environments.

• Privileged Access Management
  • Defines controls for granting, monitoring, reviewing, and securing privileged or administrative access to systems and applications.

• Protection Against Malicious Software
  • Establishes safeguards to prevent, detect, and respond to malware, ransomware, spyware, and other malicious software threats.

• Secure Electronic Communication
  • Defines requirements for securing electronic communications, including email, messaging, file sharing, and remote communications.

• Software Authorization and Monitoring
  • Establishes controls for approving, deploying, monitoring, and managing authorized software within the organization.

• System Activity Logging, Monitoring and Review
  • Defines requirements for logging, monitoring, reviewing, and retaining system and security events to support detection and investigation activities.

• Technology Registration
  • Defines requirements for registering, tracking, and maintaining an inventory of technology assets, systems, and applications.

• User Access Management Credentials Standard
  • Establishes standards for issuing, managing, securing, and reviewing user credentials and account access.

• User Access Management
  • Defines the lifecycle management process for provisioning, modifying, reviewing, and revoking user access rights.

• User Authentication Credentials Standard
  • Defines password, authentication, and credential management requirements to strengthen identity verification and access security.

• Vendor Technology Risk Management
  • Establishes requirements for assessing, monitoring, and managing cybersecurity and technology risks associated with third-party vendors and service providers.

• Secure Electronic Communication
  • Defines requirements for securing electronic communications, including email, messaging, file sharing, and remote communications.

• Vulnerability Management Standard
  • Provides detailed Operational Standards and Technical requirements for conducting vulnerability scanning, remediation, and reporting activities.

• Vulnerability Management
  • Defines the process for identifying, assessing, monitoring, prioritizing, remediation, and monitoring security vulnerabilities across systems, applications, and Infrastructure.