View source for DS4.9:

'''DS 4.9 Offsite Backup Storage '''<br>
<br>
'''Control Objective:'''<br>
<br>
Store offsite all critical backup media, documentation and other IT resources necessary for IT recovery and business continuity plans. Content of backup storage needs to be determined in collaboration between business process owners and IT personnel. Management of the offsite storage facility should respond to the data classification policy and the enterprise’s media storage practices. IT management should ensure that offsite arrangements are periodically assessed, at least annually, for content, environmental protection and security. Ensure compatibility of hardware and software to restore archived data and periodically test and refresh archived data. 
<br><br>
'''Applicability:'''<br>
<br>
:: '''Sarbanes-Oxley'''
:: HIPAA
:: GLBA
:: PCI
:: FISMA
:: NIST SP 800-66
:: Ditscap
:: Control Exception
:: User Defined
<br>
'''Risk Association Control Activities:'''<br>
::'''1.	Risk: Ongoing operations, problem resolution, an future application maintenance may not be adequately supported and users may not receive appropriate application change training.'''
:::a.	SOX.1.4: Documentation should be adequate to support ongoing operations, problem resolution, and future application maintenance.  Technical documentation should be updated to reflect program changes. 
<br>
::'''2.	Risk: Mission critical data is not available to restart applications due to systems failure.'''
:::a.	SOX.2.3.1: Up-to-date backups of programs and data should be available in emergencies.
<br>
::'''3.	Risk: The ability to change data on back up tapes is not restricted.  '''
:::a.	SOX.2.3.2: Confidential information on backed up system and transaction data is properly protected.  
<br>
::'''4.	Risk: Unauthorized or inappropriate personnel have access to data via backup tapes.  '''
:::a.	SOX.2.3.3: Confidential information on backed up system and transaction data is properly protected.
<br>
::'''5.	Risk: Up-to-date backups of programs and data may not be available when needed.'''
:::a.	SOX.2.3.4: Procedures exist and are followed to periodically test the effectiveness of the restoration process and the quality of media backup.
<br>
::'''6.	Risk: Computer equipment may be compromised by accidental damage.'''
:::a.	SOX.2.6.1: Physical storage of computer equipment should be appropriately protected to prevent the risk of accidental damage (e.g., fire, flood, smoke, water, dust, vibration, chemicals, and radiation).
<br>
::'''7.	PCI-3.2.1 Do not store the full contents of any track from the magnetic stripe (on the back of a card, in a chip, etc.)	'''
<br>
::'''8.	PCI-3.2.2 Do not store the card-validation code (Three-digit or four-digit value printed on the front or back of a payment card (e.g., CVV2 and CVC2 data))'''
<br>
::'''9.	PCI-3.2.3 Do not store the PIN Verification Value (PVV).'''
<br>
'''Implementation Guide:'''<br>
<br>
'''Process Narrative'''<br>
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.<br>
<br>
'''Process Illustration'''<br>
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.<br>
<br>
[[Image:someimage.jpg]]<br>
<br> 
'''Control Commentary'''<br>
Insert a description of the control that is applicable to the existing control statement this commentary refers to.<br>
<br>
'''Control Exception Commentary'''<br>
Insert a description of the control exception that is applicable to the existing control statement this commentary refers to.<br>
<br>
'''Evidence Archive Location'''<br>
Insert Evidence Description Here.<br> 
<br>
'''Control Status and Auditors Commentary'''<br>
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.<br>
<br>
[[Image:redlock.jpg]]<br>
<br>
'''Remediation Plan'''<br>
Insert remediation plan, applicability, or any information that indicates what needs to be done.<br>
<br>
'''Supplemental Information:'''<br>
ITIL Service Delivery<br>
ITIL IT Service Continuity Management<br>
ITIL 7.3.2 Stage 2 - Requirements analysis and strategy definition<br>
<br>
ISO 7.1 Secure areas<br>
ISO 7.2 Equipment security