Your security program.
Managed entirely by BoTech.

Security events monitored continuously. Threats investigated and contained by a qualified responder — not an automated alert queue.

EDR deployed on every endpoint in scope. Configuration managed centrally. Alerts investigated in real time. Malware signatures current.

OS and application patches tested and deployed on a defined schedule. Monthly patch compliance reports maintained. Critical patches prioritized within 72 hours.

DMARC, DKIM, and SPF configured and monitored. Anti-phishing filtering active. Email authentication prevents domain spoofing used in BEC attacks.

MFA enforced across all in-scope systems — EHR, email, cloud applications, remote access. No exceptions for administrative accounts.

SIEM deployed for log aggregation, correlation, and anomaly detection. Log retention minimum 12 months. Evidence available for regulatory investigation.

Quarterly vulnerability scans on all in-scope systems. Findings classified by severity, tracked to remediation, and reported monthly.

ePHI and critical data backed up to a secure offsite location. Restore tested quarterly. RTO and RPO defined, documented, and verified.

Firewall rule review, network segmentation verification, and traffic anomaly monitoring. Remote access controlled via MFA-protected VPN.

Written incident response plan with named first responders. P1 critical incidents receive a one-hour response commitment — guaranteed in writing in your service agreement.