Vendor Name (required) Vendor's Legal Name Vendor Email (required) Vendor's Email Address System Name (required) Name of the system for the title of the Certification Report System Identifier (required) The Subsystem identifier uniquely defines the implementation of the subsystem such as a version or model number Description (required) Brief Description of the system under test Functional Description (required) Details functional description including inputs, outputs, input interface description, output interface description, physical and logical boundaries, and security boundaries of the system. * If an application provider has multiple versions of the application, all of which use the same code and controls for the functions that DEA is requiring, a single audit may be able to address multiple versions if other changes could not impact these functions. The following will determine which requirements of the DEA's interim final rule will be audited for compliance. Is the application system to be certified for prescribing or signing prescriptions? yesno Is the certification for a system for individual practitioners? yesno Is the certification for a system for institutional practitioners? yesno Will the system be used to prescribe Schedule II level prescriptions? yesno Will the system be used to prescribe Schedule III and IV level prescriptions? yesno Will the system be used to prescribe Schedule V level prescriptions? yesno Does the system support a written record of an emergency oral prescription? yesno Are e-prescriptions submitted directly to the pharmacy (no intermediary)? yesno Are any e-prescriptions submitted through an intermediary? yesno Does the system support prescribing for a Schedule III, IV, or V narcotic drug approved by the FDA specifically for "detoxification treatment" or "maintenance treatment"? yesno Is the system used to prescribe GHBA (Xyrem -- Schedule III)? yesno Has the ID proofing for access control been establihed? yesno Does the practitioner use his/her own digital certificate (PKI) to sign electronic controlled substance prescriptions? (If no, then a digital certificate is assumed) yesno What 2-factor credentials will be provided in the system under test? Password yesno Hard token (verify compliance to FIPS 140-2 Security Level 1) yesno Biometrics (please identify the modality) yesno *Please list any additional information about the system that might be useful for iBeta to establish a proposal Δ
