Metallic SaaS Backup

Protection of Audit Trail Files (10.5.2)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

File-integrity Monitoring On Logs (10.5.5)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

Daily Log Reviews (10.6.1)

Date and Time is Logged (10.3.3)

Logging Audit Trails (10.2.3)

Type of Event is Logged (10.3.2)

Least Privilege Access (7.1.2)

User Identification is Logged (10.3.1)

Limiting Access to Cardholder Data (7.1)

Success or Failure Indication is Logged (10.3.4)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

Audit Trail Files Back-up (10.5.3)

Access Control System Restrictions (7.2)

A formal risk management process is established to evaluate risks based on identified threats and specified tolerances. This process includes defining risk assessment methodologies, risk categories, and evaluation criteria.

Risk assessments are performed at least annually during security committee management meetings and include evaluations of the following: -Organizational structure, capability, capacity, reporting lines, authorities, and responsibilities. -Environmental, regulatory, and technological changes that have occurred. -The need for additional tools and resources to achieve business objectives. -Threats and vulnerabilities affecting the achievement of commitments to clients.

Results of the risk assessment, including identified risks and recommended actions, are communicated to the respective owners to ensure accountability for addressing risks.

Identified risks and associated action items are documented and tracked through an ongoing risk register to monitor progress and ensure timely resolution.

7.10 Storage media - Storage media shall be managed through their life cycle of acquisition, use, transportation, and disposal in accordance with the organization's classification scheme and handling requirements.

7.4 Physical security monitoring - Premises shall be continuously monitored for unauthorized physical access.

7.5 Protecting against physical and environmental threats - Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.

7.9 Security of assets off premises - Off-site assets shall be protected.

Facilitates international collaboration on ICT matters.

What measures are in place to mitigate the risk of losing key clients or accounts? (Client Loss)