Demo ModeSample Data Only

This is a Demo Compliance Environment

No real customer data is stored here. All organizations, evidence, assessments, and control updates are seeded sample/demo data for product demonstrations.

Active demo organization: King's Healthcare, Inc. (Demo Organization)

Demo Organization Switcher

Vendor self-assessment workspace

marv

MediTech HIPAA + NIST 800-171 Audit

Status: IN PROGRESSCustomer: Ball State UniversityEngagement: Ball State Vendor Risk ProgramDue: Apr 13, 20261 framework

Control Library Evidence Center Open Audit Review

Assigned Assessments

Switch between vendor audits and framework-specific questionnaires.

MediTech HIPAA + NIST 800-171 Audit MediTech HIPAA + NIST 800-171 Audit King's FinTech, Inc. Assurance Readiness Sprint King's FinTech, Inc. Control Validation Review King's FinTech, Inc. Annual Security Compliance Audit 2026

Total Controls

1 framework scope

Applied Controls

3 fully implemented

Tasks (Open)

0 overdue POA&M items

Evidence Linked

0 awaiting customer review

High-Risk Gaps

0 needs info/rejected

Control Completion

Answered controls vs total in scope

3 / 6

50% complete

Submission Readiness

Combines completion, evidence, and open high-risk gaps

28%

28% complete

Risk Assessment Score

Higher is better (lower open-risk exposure)

88% complete

Control Status Breakdown

Implementation state distribution across this audit scope.

Controls

Implemented

50%

Open

50%

Request Queue Breakdown

What is blocking submission or requires follow-up.

No chart data available yet.

Domain Completion

Answered controls by domain (top incomplete domains surface first).

Framework Scope

Frameworks currently included in this vendor assessment.

HIPAA Security Rule

HIPAA · 45 CFR 164

6 controls

50%

Domain Progress

Accordion view for control domains, completion, evidence, and top gaps.

Physical Safeguards

0 / 1 controls answered

0 implemented1 open

Implementation Coverage

Includes fully implemented controls only

Evidence Coverage

Controls with at least one linked evidence item

High Risk Gaps

Open controls marked High/Critical

Top Gaps

164.310(d)(1) Device and Media Controls

NOT IMPLEMENTED—

Administrative Safeguards

1 / 2 controls answered

50%

1 implemented1 open

Implementation Coverage

50%

Includes fully implemented controls only

Evidence Coverage

Controls with at least one linked evidence item

High Risk Gaps

Open controls marked High/Critical

Top Gaps

164.308(a)(5)(ii)(C) Log-in Monitoring

NOT IMPLEMENTED—

Technical Safeguards

1 / 2 controls answered

50%

1 implemented1 open

Implementation Coverage

50%

Includes fully implemented controls only

Evidence Coverage

Controls with at least one linked evidence item

High Risk Gaps

Open controls marked High/Critical

Top Gaps

164.312(a)(1) Access Control

NOT IMPLEMENTED—

Policies & Procedures

1 / 1 controls answered

100%

1 implemented0 open

Implementation Coverage

100%

Includes fully implemented controls only

Evidence Coverage

Controls with at least one linked evidence item

High Risk Gaps

Open controls marked High/Critical

Top Gaps

No open gaps in this domain.

Customer Requests / POA&M

Controls needing remediation action, evidence, or reviewer follow-up.

164.308(a)(1)(ii)(A) Risk Analysis

—

IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

164.308(a)(5)(ii)(C) Log-in Monitoring

—

NOT IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

164.310(d)(1) Device and Media Controls

—

NOT IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

164.316(b)(1) Documentation Retention

—

IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

164.312(a)(1) Access Control

—

NOT IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

164.312(b) Audit Controls

—

IMPLEMENTEDDRAFTevidence neededowner unassigned13d overdue

Control Workbench

Vendor-ready questionnaire table for implementation status, risk, owners, and evidence.

Control	Domain	Framework	Status	Customer Review	Evidence Review	Risk	Evidence	POA&M	Owner	Due
164.308(a)(1)(ii)(A) Risk Analysis	Administrative Safeguards	HIPAA	IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue
164.308(a)(5)(ii)(C) Log-in Monitoring	Administrative Safeguards	HIPAA	NOT IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue
164.310(d)(1) Device and Media Controls	Physical Safeguards	HIPAA	NOT IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue
164.316(b)(1) Documentation Retention	Policies & Procedures	HIPAA	IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue
164.312(a)(1) Access Control	Technical Safeguards	HIPAA	NOT IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue
164.312(b) Audit Controls	Technical Safeguards	HIPAA	IMPLEMENTED	DRAFT	—	—	Missing	—	—	Apr 13, 2026 13d overdue

This vendor workspace is designed for customer-facing audits and self-assessments. It supports framework-scoped progress tracking, evidence collection, and POA&M-style remediation queues for HIPAA, NIST CSF, SOC 2, ISO 27001, CIS Controls, and the added NIST 800-171 / 800-172 / 800-53 frameworks.