Security Posture Score Report

This report provides information about the security parameters that are configured in the Commvault Cloud environment. Users can add new controls and features to improve the overall management security. You can view the parameters categorized based on the status by selecting the status tab available at the top of the page.

The column in each section of the Security posture score report includes the following information:

Status: The current status of the parameter, including whether the parameter is in the Good, the Info, or the Warning status.
Parameter: The name of the security setting, the feature, or the option in the Commvault Cloud environment.
Current setting: The security setting that is currently configured in the Commvault Cloud environment.
Recommendation: The recommended configuration for the security setting within the Commvault Cloud environment.
Remarks: A message about the status of the parameter. You can view the information about the feature or the setting from the link that either opens the related document or a related report.
Actions: You enable or perform other applicable actions for the parameter using the Action button . After updating security settings, you must wait until after the next data collection process runs to view any changes in the Security Assessment report.

To view this report, in the Security IQ Dashboard, in the Security Posture Tile, click View Your Security Posture.

The following are the categories under which the parameters are grouped:

Audit trail

The Audit Trail table displays the duration of the Audit trail events retained. Audit trail information is managed by Commvault Cloud.

Parameter	Description
Audit trail	The information about the duration of the audit trail details preserved for Critical, High, Medium, and Low severity events.

Authentication and Authorization

The Authentication and Authorization table displays the information about the parameters providing controls for user access and their access level to back up data in the Commvault Cloud environment.

Parameter	Description
External authentication	The information about the external identity provider configured to authenticate the Commvault Cloud environment.
Failed login lockout count	The number of failed log-on attempts that are allowed before the user is locked out. This is managed by Commvault Cloud in accordance to AC-7 in NIST 800-53 publication. The default value is set to 3 failed login attempts.
Account lockout duration	The duration the account is locked after exceeding the failed login count. The default value is set to 30 minutes.
Delete authorization	An indication of whether Delete authorization is enabled in the Commvault Cloud environment. When the Delete authorization is enabled then additional administrative approval is required. The approval request is sent via email to all the administrators, and the request can be approved or denied by any other administrator. You must have a secondary tenant administrator account to use Delete authorization feature. The Delete authorization supports server deletion, mount path deletion, job deletion and plan deletion. If this feature is enabled, then the tenant administrator will not receive the email notification and also, it cannot be disabled.
Restore authorization	An indication of whether the Restore authorization is enabled in the Commvault Cloud environment. When the Restore authorization is enabled then additional administrative approval is required. The approval request is sent via email to all the administrators, and the request can be approved or denied by any other administrator. You must have a secondary tenant administrator account to use Restore authorization feature. If this feature is enabled, then the tenant administrator will not receive the email notification and also, it cannot be disabled. Note The restore authorization and size calculation feature works only for File System agents, AliCloud hypervisor, and VMWare V2 hypervisor.

Security Control

The security control table displays information about backup data security control.

Parameter	Description
Key Management	Displays the third-party key management used in the Commvault Cloud environment.
Storage with encryption	An indication of whether the storage is encrypted. Commvault Cloud encrypts storage by default.
Compliance Lock	To protect data from retention policy changes and prevents malicious or accidental deletion. The Compliance Lock is available only for the companies that have backup storage. The compliance lock provides the following protection: The data, backup destinations, and servers and plans associated with the backup destinations in the locked storage cannot be deleted. It is still possible to delete a plan or reassociate a server to a new plan when the compliance lock is enabled. This is a nondestructive task since backup protected on locked storage cannot be deleted and are recoverable for the retention period that was initially set. The retention period cannot be reduced for the backup destinations. Compliance lock is enabled by default for Air Gap Protect and bundled storage, and must be manually enabled for user-provided storage. If this feature is enabled then it cannot be disabled.

Parameter

Description

Key Management

Displays the third-party key management used in the Commvault Cloud environment.

Storage with encryption

An indication of whether the storage is encrypted. Commvault Cloud encrypts storage by default.

Compliance Lock

To protect data from retention policy changes and prevents malicious or accidental deletion. The Compliance Lock is available only for the companies that have backup storage.

The compliance lock provides the following protection:

The data, backup destinations, and servers and plans associated with the backup destinations in the locked storage cannot be deleted.

It is still possible to delete a plan or reassociate a server to a new plan when the compliance lock is enabled. This is a nondestructive task since backup protected on locked storage cannot be deleted and are recoverable for the retention period that was initially set.
The retention period cannot be reduced for the backup destinations.

Compliance lock is enabled by default for Air Gap Protect and bundled storage, and must be manually enabled for user-provided storage.

If this feature is enabled then it cannot be disabled.