164.308(a)(1)(ii)(A) Risk Analysis (Required)
Administrative safeguard · Required
The requirement as we hold it
Risk Analysis (Required). Conduct accurate and thorough assessment of potential risks and vulnerabilities to ePHI. NIST recommends the nine-step risk analysis methodology and integration with NIST SP 800-30 and the NIST RMF.
The examiner asks
- Show me the risk analysis and tell me its date. Walk me through how you scoped the ePHI in it.
- Which threats and vulnerabilities does it list, and how did you rate likelihood and impact?
Evidence to bring
- the dated risk analysis
- the ePHI scope it covers
Source: 164.308(a)(1)(ii)(A) at eCFR. Our statement of the clause, not the instrument verbatim.