sync: auto-sync from HOWARD-HOME at 2026-07-15 12:21:30
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-15 12:21:30
This commit is contained in:
@@ -10,19 +10,26 @@
|
||||
- Former Admin: admin@NETORGFT4257522.onmicrosoft.com (Sandra Fish — previous director, removed 2026-04-14: global admin revoked, sign-in blocked, P2 license removed)
|
||||
- DirSync / Entra Connect: **Not configured** (all accounts cloud-only) — **PLANNED: Install Entra Connect for SSO**
|
||||
- HIPAA BAA: **Covered by MCA** — Microsoft Customer Agreement automatically includes the HIPAA BAA for Business plan subscribers (confirmed 2026-05-14, no separate acceptance needed)
|
||||
- MFA: **Not enabled** — Security Defaults not configured
|
||||
- MFA: **Enabled for all staff** via Conditional Access (live; caregivers protected by on-network restriction + 8h sign-in frequency instead of MFA prompts). Earlier "not enabled" note was pre-CA-rollout.
|
||||
|
||||
## Licensing
|
||||
## Licensing (updated 2026-07-15 — live Graph verification by Mike/GURU-5070)
|
||||
|
||||
| License Type | Total | Assigned | Available |
|
||||
|---|---|---|---|
|
||||
| Microsoft 365 Business Standard | 34 | 34 | 0 |
|
||||
| Microsoft 365 Business Premium | 45 | 41 | 4 |
|
||||
| Microsoft 365 Business Standard | **SUSPENDED** | 30 consumed | — |
|
||||
| Microsoft Entra ID P2 | 1 | 0 | 1 (unassigned — was Sandra Fish, available for testing) |
|
||||
| Microsoft Power Automate Free | 10000 | 2 | 9998 |
|
||||
| Microsoft Stream Trial | 1000000 | 0 | 1000000 |
|
||||
| Exchange Online Essentials | — | 4 | — |
|
||||
|
||||
**Note:** Business Standard is fully allocated (34/34, 0 available). Any new hires require purchasing additional licenses.
|
||||
**Note (2026-07-15):** The Business Premium migration is largely done — 45 Premium owned,
|
||||
41 assigned (the caregiver rollout). The old Business Standard subscription is **suspended**
|
||||
with ~30 office staff still sitting on it; none of them hold Premium. Moving them is
|
||||
**net-new spend** (~26 net-new paid seats ≈ $572/mo; best case ~17 net-new ≈ $374/mo after
|
||||
converting 8 role/shared mailboxes — accounting@, hr@, frontdesk@, etc. — to free shared
|
||||
mailboxes and removing former employee jodi.ramstack). The per-user table below predates
|
||||
this and reflects the old Standard assignments.
|
||||
|
||||
### Planned expansion — caregiver rollout (not yet purchased)
|
||||
|
||||
|
||||
@@ -89,6 +89,7 @@
|
||||
table.todo td.tgt{ font-family:var(--f-mono); font-size:8px; color:var(--accent-ink);
|
||||
font-weight:500; white-space:nowrap; }
|
||||
table.todo td.cost{ font-family:var(--f-mono); font-size:8px; color:var(--ink-2); white-space:nowrap; }
|
||||
table.todo td.comp{ font-family:var(--f-mono); font-size:8px; color:var(--ink-3); min-width:46px; }
|
||||
|
||||
table.mach{ border-collapse:collapse; width:calc(100% - 29px); margin:3px 0 0 29px; }
|
||||
table.mach th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
|
||||
@@ -135,18 +136,29 @@
|
||||
<div class="eyebrow">Technology Plan · FY 2026–2027</div>
|
||||
<h1>Cascades of Tucson Technology Plan</h1>
|
||||
<p class="lede">A living action document: for each area of the facility's technology, what has
|
||||
been done and what is planned, with an owner, cost, and target for every action. Prepared with
|
||||
been done and what is planned, with an owner, cost, target, and completion date for every action. Prepared with
|
||||
Az Computer Guru. Reviewed and updated at least annually.</p>
|
||||
</div>
|
||||
|
||||
<div class="gov">
|
||||
<div><span class="k">Plan owner</span><span class="v">Cascades of Tucson</span></div>
|
||||
<div><span class="k">Plan owner</span><span class="v">Cascades of Tucson — Administrator (Ashley Jensen)</span></div>
|
||||
<div><span class="k">Prepared with</span><span class="v">Az Computer Guru</span></div>
|
||||
<div><span class="k">Plan period</span><span class="v">FY 2026–2027</span></div>
|
||||
<div><span class="k">Adopted by / date</span><span class="v"><i>at adoption</i></span></div>
|
||||
<div><span class="k">Next annual review</span><span class="v"><i>adoption + 12 months</i></span></div>
|
||||
<div style="grid-column:1/-1"><span class="k">Standard reference</span><span class="v">CARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — <i>manual edition confirmed at adoption</i></span></div>
|
||||
</div>
|
||||
|
||||
<div class="band-label">Basis of this plan</div>
|
||||
<p class="lede" style="max-width:none">This plan is based on the needs of the people Cascades serves and the people who serve them.
|
||||
<b>Persons served:</b> resident safety (Helpany fall/motion sensors with no camera and no microphone), reliable building-wide
|
||||
WiFi for residents and families, and protection of resident health records. <b>Personnel:</b> dependable workstations, one
|
||||
sign-on to the clinical record, and secure access that follows staff roles. <b>Other stakeholders:</b> families (connectivity
|
||||
and privacy), regulators (HIPAA safeguards), and vendors (managed under Business Associate Agreements).</p>
|
||||
<p class="lede" style="max-width:none">Technology priorities align with Cascades' strategic goals: resident safety first (safety sensors, proven power-outage
|
||||
recovery), regulatory standing (HIPAA safeguards, CARF conformance, auditable records), and efficient operations (modern
|
||||
workstations, single sign-on, and a sanctioned analytics path for leadership).</p>
|
||||
|
||||
<div class="band-label">The eight areas</div>
|
||||
|
||||
<section class="area">
|
||||
@@ -159,11 +171,11 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td></tr>
|
||||
<tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td></tr>
|
||||
<tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td></tr>
|
||||
<tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
<span class="lbl lbl--todo">Workstations marked for replacement</span>
|
||||
<table class="mach">
|
||||
@@ -187,11 +199,11 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else</td><td class="own">ACG</td><td class="cost">reduces monthly cost</td><td class="tgt">30 days</td></tr>
|
||||
<tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
|
||||
<tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td></tr>
|
||||
<tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere</td><td class="own">ACG</td><td class="cost">new licensing, ~$375–575/mo</td><td class="tgt">30 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td><td class="comp"></td></tr>
|
||||
<tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -207,13 +219,13 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td></tr>
|
||||
<tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
|
||||
<tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
|
||||
<tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td></tr>
|
||||
<tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td></tr>
|
||||
<tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td><td class="comp"></td></tr>
|
||||
<tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -226,11 +238,11 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
|
||||
<tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
|
||||
<tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
|
||||
<tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -243,10 +255,10 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
|
||||
<tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
|
||||
<tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -259,9 +271,9 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td></tr>
|
||||
<tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -274,10 +286,10 @@
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
|
||||
<tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
|
||||
<tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
@@ -285,15 +297,15 @@
|
||||
<div class="area__head"><span class="area__no">08</span><h2 class="area__title">Virus & threat protection</h2></div>
|
||||
<span class="lbl lbl--done">Done</span>
|
||||
<ul class="done">
|
||||
<li>Managed endpoint detection & response (EDR) on every managed device (about 35), <b>including the main server</b> (completed July 2026).</li>
|
||||
<li>Managed endpoint detection & response (EDR) on every managed, enrolled device (35), <b>including the main server</b> (verified live July 2026).</li>
|
||||
<li>Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.</li>
|
||||
<li>Legacy agents from the previous IT provider removed from the server.</li>
|
||||
</ul>
|
||||
<span class="lbl lbl--todo">To do</span>
|
||||
<table class="todo">
|
||||
<tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
|
||||
<tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
|
||||
<tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td></tr>
|
||||
<tr><th style="width:46%">Action</th><th>Owner</th><th>Cost</th><th>Target</th><th>Completed</th></tr>
|
||||
<tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td><td class="comp"></td></tr>
|
||||
<tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td><td class="comp"></td></tr>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
|
||||
@@ -5,12 +5,28 @@
|
||||
|
||||
| Governance | |
|
||||
|---|---|
|
||||
| Plan owner | Cascades of Tucson |
|
||||
| Plan owner | Cascades of Tucson — Administrator (Ashley Jensen) |
|
||||
| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
|
||||
| Standard reference | CARF Technology and System Plan, Aging Services Standards Manual (Section 1, "CARF Plans") — *[manual edition confirmed at adoption]* |
|
||||
| Plan period | FY 2026–2027 |
|
||||
| Adopted by / date | *[at adoption]* |
|
||||
| Next annual review | *[adoption + 12 months]* |
|
||||
|
||||
## Basis of this plan
|
||||
|
||||
This plan is based on the needs of the people Cascades serves and the people who serve
|
||||
them. **Persons served:** resident safety (Helpany fall/motion sensors with no camera and
|
||||
no microphone), reliable building-wide WiFi for residents and families, and protection of
|
||||
resident health records. **Personnel:** dependable workstations, one sign-on to the
|
||||
clinical record, and secure access that follows staff roles. **Other stakeholders:**
|
||||
families (connectivity and privacy), regulators (HIPAA safeguards), and vendors (managed
|
||||
under Business Associate Agreements).
|
||||
|
||||
Technology priorities align with Cascades' strategic goals: resident safety first (safety
|
||||
sensors, proven power-outage recovery), regulatory standing (HIPAA safeguards, CARF
|
||||
conformance, auditable records), and efficient operations (modern workstations, single
|
||||
sign-on, and a sanctioned analytics path for leadership).
|
||||
|
||||
---
|
||||
|
||||
## 1. Hardware
|
||||
@@ -22,8 +38,8 @@
|
||||
- Windows Pro upgrades completed on nearly all workstations for domain readiness.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
|
||||
| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
|
||||
| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
|
||||
@@ -48,9 +64,9 @@
|
||||
department structure and drive mapping built.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Move office staff off the suspended legacy Microsoft 365 license onto supported licenses; full Office only where needed, lighter licenses elsewhere | ACG | new licensing, ~$375–575/mo depending on mix | 30 days |
|
||||
| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
|
||||
| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
|
||||
| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
|
||||
@@ -66,8 +82,8 @@
|
||||
- Email authentication (SPF, DKIM, DMARC) enforced.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
|
||||
| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
|
||||
| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
|
||||
@@ -82,8 +98,8 @@
|
||||
- Shared care devices auto-lock; resident and voice traffic isolated on the network.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
|
||||
| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
|
||||
| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
|
||||
@@ -97,8 +113,8 @@
|
||||
- Firewall and network configuration backed up.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
|
||||
| Run and document a test restore | ACG | labor | 90 days |
|
||||
| Confirm and document the retention policy | ACG | none | 60 days |
|
||||
@@ -111,8 +127,8 @@
|
||||
- Building-wide WiFi supporting resident and family connectivity.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
|
||||
| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
|
||||
|
||||
@@ -124,8 +140,8 @@
|
||||
- UPS battery backup installed on core equipment and all network switches; off-site backup running.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
|
||||
| Documented restore test (with area 5) | ACG | labor | 90 days |
|
||||
| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
|
||||
@@ -133,16 +149,16 @@
|
||||
## 8. Virus & threat protection
|
||||
|
||||
**Done**
|
||||
- Managed endpoint detection & response (EDR) on every managed device (about 35),
|
||||
**including the main server** (completed July 2026).
|
||||
- Managed endpoint detection & response (EDR) on every managed, enrolled device (35),
|
||||
**including the main server** (verified live July 2026).
|
||||
- Microsoft Defender and Exchange Online Protection on email; managed monitoring and
|
||||
patching on all devices.
|
||||
- Legacy agents from the previous IT provider removed from the server.
|
||||
|
||||
**To do**
|
||||
| Action | Owner | Cost | Target |
|
||||
|---|---|---|---|
|
||||
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
|
||||
| Action | Owner | Cost | Target | Completed |
|
||||
|---|---|---|---|---|
|
||||
| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement); finish console cleanup | ACG | labor | 30–60 days |
|
||||
| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
|
||||
|
||||
---
|
||||
|
||||
Binary file not shown.
Reference in New Issue
Block a user