Open System Controls — §11.30

Controls for Open Systems. Where electronic records are created, modified, maintained, or transmitted using open systems (i.e., systems in which system access is not controlled by persons responsible for the content of the electronic records), the organization shall employ additional measures designed to ensure the authenticity, integrity, and confidentiality of such records from the point of their creation to the point of their receipt, in accordance with §11.30. In addition to all controls required for closed systems under §11.10, open system controls shall include: (a) encryption of electronic records during transmission using industry-standard cryptographic protocols (e.g., TLS 1.2 or higher, AES-256 or equivalent) to protect against unauthorized interception, modification, or disclosure; (b) use of digital signatures conforming to an established standard (e.g., FIPS 186-4 or equivalent) to verify the identity of the sender and the integrity of the transmitted record; (c) implementation of message authentication codes (MACs) or hash functions to detect any alteration of records during transmission; (d) use of secure network architectures, including firewalls, intrusion detection/prevention systems, and virtual private networks (VPNs), to protect open system boundaries; (e) certificate-based authentication of all parties involved in the transmission of electronic records; and (f) documented procedures for the secure exchange of electronic records, including the verification of receipt and completeness by the receiving party. The adequacy of open system controls shall be assessed as part of the system risk assessment and validated accordingly.