Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• BCD-23_A01 a backup architecture is documented that identifies backup storage locations, data flows and the mechanisms used to protect backup copies.
  Assessment rigor: 1
  Origin: SCF Created
• BCD-23_A02 backup copies are stored in an immutable form (e.g., Write Once Read Many (WORM) storage, object lock or retention lock) that prevents modification or deletion for the defined immutability period.
  Assessment rigor: 1
  Origin: SCF Created
• BCD-23_A03 the period for which backup copies remain immutable is defined.
  Assessment rigor: 3
  Origin: SCF Created
• BCD-23_A04 backup copies and backup infrastructure are protected from unauthorized access, including through encryption of backup data and access restrictions on backup repositories.
  Assessment rigor: 1
  Origin: SCF Created
• BCD-23_A05 privileged actions on the backup infrastructure (e.g., deleting backups or changing retention or immutability settings) are restricted to authorized personnel, require multi-factor authentication and are logged.
  Assessment rigor: 1
  Origin: SCF Created
• BCD-23_A06 the immutability of backup copies is tested at a defined frequency and the results are documented.
  Defined parameters: at least quarterly
  Assessment rigor: 2
  Origin: SCF Created

Prepojené úlohy

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.