Commvault Cloud

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Production Data for Development (6.4.3)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Daily Log Reviews (10.6.1)

Date and Time is Logged (10.3.3)

Logging Audit Trails (10.2.3)

Type of Event is Logged (10.3.2)

Policies and Procedures (6.7)

Origination of Event is Logged (10.3.5)

User Identification is Logged (10.3.1)

Success or Failure Indication is Logged (10.3.4)

Implementing Audit Trails (10.1)

Logging User Access to Cardholder Data (10.2.1)

Audit Trail Files Back-up (10.5.3)

Separating Duties Between Development/test and Production Environments (6.4.2)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

8.14 Redundancies of information processing facilities - Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.18 Use of privileged utility programs - The use of utility programs that can be capable of overriding system and application controls shall be restricted and tightly controlled.

8.3 Information access restriction - Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

Outlines ICT governance roles for senior management.

Details structural organization to manage ICT risk.

Creates an EU-level oversight structure for critical vendors.

Criteria used to designate providers as critical.

Defines the obligations of designated providers.