Benchmark: 164.308(a)(3)(ii) Implementation specifications
Description
Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. Implement procedures to determine that a workforce member's access to electronic protected health information is appropriate. Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-gcp-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 164.308(a)(3)(ii) Implementation specifications.
Run this benchmark in your terminal:
powerpipe benchmark run gcp_compliance.benchmark.hipaa_164_308_a_3_iiSnapshot and share results via Turbot Pipes:
powerpipe benchmark run gcp_compliance.benchmark.hipaa_164_308_a_3_ii --shareControls
- Ensure that Compute instances do not have public IP addresses
 - Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
 - Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
 - Ensure that Separation of duties is enforced while assigning KMS related roles to users
 - Prevent a public IP from being assigned to a Cloud SQL instance
 - Check if BigQuery datasets are publicly readable
 - Check if Cloud Storage buckets have Bucket Only Policy turned on
 - Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
 - Ensure Instance IP assignment is set to private
 - Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
 - Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
 - Ensure that Cloud Storage buckets used for exporting logs are configured using bucket lock