Veritas NetBackup

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

Media Destruction (9.8)

Storing Media Backups (9.5.1)

Access to client data requires a unique ID assigned to each user.

All system access for terminated or disabled employees and consultants is removed within 24 hours of receiving a notification from the business or HR.

All access requests, including those for employees, temporary employees, consultants, and system accounts, are reviewed and approved by the appropriate level of business and IT management before provisioning.

ID.IM-01: Improvements are identified from evaluations

ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities

ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

PR.PS-01: Configuration management practices are established and applied

PR.PS-02: Software is maintained, replaced, and removed commensurate with risk

PR.PS-05: Installation and execution of unauthorized software are prevented

8.15 Logging - Logs that record activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analyzed.

8.32 Change Management - Changes to information processing facilities and information systems shall be subject to change management procedures.

Facilitates international collaboration on ICT matters.