Commvault Complete Backup & Recovery

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

Daily Log Reviews (10.6.1)

Type of Event is Logged (10.3.2)

Success or Failure Indication is Logged (10.3.4)

Audit Trail Files Back-up (10.5.3)

GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

GV.OC-04: Critical objectives, capabilities, and services that stakeholders depend on or expect from the organization are understood and communicated

ID.AM-01: Inventories of hardware managed by the organization are maintained

ID.AM-02: Inventories of software, services, and systems managed by the organization are maintained

5.12 Classification of Assets - Information shall be classified according to the information security needs of the organization based on confidentiality, integrity, availability, and relevant interested party requirements.

5.14 Information Transfer - Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties.

5.29 Information security during disruption - The organization shall plan how to maintain information security at an appropriate level during disruption.

8.14 Redundancies of information processing facilities - Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements.

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.16 Monitoring activities - Networks, systems, and applications shall be monitored for anomalous behavior and appropriate actions taken to evaluate potential information security incidents.

Defines the scope of digital resilience testing.

Details tools for vulnerability and performance testing.

Mandates risk controls for ICT third-party services.

Providers must be vetted prior to engagement.

Contracts must include specific operational clauses.

Requires exit and transition strategies for continuity.