DCH is enhancing its application risk management and system security review practices through the following corrective actions: • Enterprise Risk Management Framework: DCH operates under a HITRUST i1-validated information security program and is pursuing HITRUST r2 validation in Fall 2026. This fram...
DCH is enhancing its application risk management and system security review practices through the following corrective actions: • Enterprise Risk Management Framework: DCH operates under a HITRUST i1-validated information security program and is pursuing HITRUST r2 validation in Fall 2026. This framework provides standardized, risk-based controls for identifying, assessing, and managing security risks across Medicaid and CHIP systems and supporting services. • ServiceNow IRM, SecOps, and TPRM Implementation: DCH is implementing ServiceNow modules for Integrated Risk Management (IRM), Security Operations (SecOps), and Third-Party Risk Management (TPRM) to centralize risk identification, SOC report intake, CUEC tracking, issue management, and remediation evidence. These capabilities will support consistent documentation, traceability, and auditability of risk management and third-party oversight activities. • System Security Reviews (SSRs) and SOC Report Validation: DCH will formalize and document its System Security Review (SSR) process for in-scope systems and third-party service providers. This includes: o Establishing documented procedures for annual review of SOC Type II reports and applicable CUECs. o Performing and retaining evidence of management review to assess control design and operating effectiveness. o Tracking SSR results, deficiencies, and remediation activities through ServiceNow IRM/TPRM. Ensuring SSRs are performed consistently and retained as auditable artifacts. These corrective actions are designed to provide reasonable assurance that application-level and third-party risks are identified, reviewed, documented, and managed in compliance with state and federal requirements.