Veritas Backup Exec

Securing Cryptographic Key Storage (3.6.3)

Minimizing Cardholder Data Storage (3.1)

Managing PAN Data Storage (3.4)

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

Antivirus software is installed on workstations, laptops, and systems supporting such software.

Agreements with Vendors and Business Partners include privacy and confidentially clauses. If any of the vendors are SaaS, then their respective SOC1/2 reports are obtained and reviewed periodically.

GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

GV.OV-02: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

GV.OV-03: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident

RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

Mandates risk controls for ICT third-party services.

Entities must monitor provider performance regularly.

Requires exit and transition strategies for continuity.

Protect Recovery Data

Ensure Network Infrastructure is Up-to-Date

Establish and Maintain a Secure Network Architecture

Securely Manage Network Infrastructure