• Validate that all remote access to the organization’s network and privileged or administrative access requires multi-factor authentication.

• Ensure that software is up to date, prioritize updates that address known exploited vulnerabilities identified by CISA.

• Confirm that the organization’s IT personnel have disabled all ports and protocols that are not essential for business purposes.

• If the organization is using cloud services, ensure that IT personnel have reviewed and implemented strong controls outlined in CISA's guidance.

• Ensure that cybersecurity/IT personnel are focused on identifying and quickly assessing any unexpected or unusual network behavior. Enable logging to better investigate issues or events.

• Confirm that the organization's entire network is protected by antivirus/anti-malware software and that signatures in these tools are updated.

• Designate a crisis-response team with main points of contact for a suspected cybersecurity incident and roles/responsibilities within the organization, including technology, communications, legal, and business continuity.

• Conduct a tabletop exercise to ensure that all participants understand their roles during an incident.

• Test backup procedures to ensure that critical data can be rapidly restored if the organization is impacted by ransomware or a destructive cyberattack; ensure that backups are isolated from network connections.

• If using industrial control systems or operational technology, conduct a test of manual controls to ensure that critical functions remain operable if the organization’s network becomes unavailable or untrusted.

• Chestertown Police Department 

• Allied Trailer, Cambridge, MD

• PIVOT Physical Therapy 

• University of Maryland 

• Peninsula Cardiology Associates

• Local 486 Delmarva Training School

• ENTAA Care

• Ability to meet physical security requirements

• Responsiveness of the provider’s customer support 

• Uptime service-level agreements