Manifestly: A Checklist App for Teams

Inventory states triggering Part 500 and Model Law

Refresh the GLBA Safeguards WISP

Confirm CISO designation under §500.4

File the §500.17 certification of compliance

Refresh GLBA privacy notices for state variants

Run the §500.9 cybersecurity risk assessment

Inventory NPI across PolicyCenter and the AMS

Conduct a privacy impact assessment on new processing

Document data subject and consumer request procedures

Verify encryption of NPI in transit and at rest

Confirm MFA on all external network access

Review role-based access and producer entitlements

Sample claim and policy access logs

Update the §500.16 incident response plan

Run a tabletop exercise on a simulated breach

Document the 72-hour DOI notification protocol

Were findings identified requiring remediation?

Open remediation items in the GRC tracker

Refresh the policy and claim file retention schedule

Validate automated deletion in ImageRight and the AMS

Verify certificates of destruction from disposal vendors

Refresh the §500.11 third-party service provider inventory

Collect SOC 2 Type II reports from critical vendors

Update data protection clauses in vendor contracts

Sign off on the annual data protection review

Free Checklist Templates for Data Security