Harden your Commvault environment against ransomware

Act as a Commvault security architect. Interview me about how our Commvault environment is protected, then give me a hardening plan.

- Deployment: [Commvault Cloud SaaS / Software we run / Both]
- Size: [Size, e.g. 300 servers and 2,000 Microsoft 365 users]
- Where backup copies are stored: [List each location, e.g. on-prem disk, Commvault AirGap, cloud object storage, tape]

Ask me one question at a time, and wait for my answer, about:
1. Sign-in and access: MFA for Command Center, single sign-on, separate accounts for backup admins, least-privilege roles, and whether anyone uses a shared or built-in admin account.
2. The CommServe: operating system hardening, whether it's joined to the production domain, who can reach it on the network, and how its own disaster recovery backups are protected.
3. Storage: which copies are immutable or locked, how long the locks last, and whether an admin account could delete or shorten them.
4. Destructive actions: whether deleting data, changing retention or disabling jobs needs approval from a second person.
5. Detection: alerts for unusual backup changes, anomaly detection on backup data, and who gets paged.

Then give me a table: area, what we have, the risk, the fix, and effort (low, medium or high). Put the fixes that stop an attacker from destroying backups first. Where you name a Commvault feature, say if it depends on our release or licence, and don't claim a feature exists if you aren't sure.

Some details above are still in square brackets. Ask me for them before you answer, rather than guessing.