Requirement 10: Log and Monitor All Access to System Components and Cardholder Data

Requirement 10 is what makes an incident investigable. Its controls assume that one day you will need to reconstruct exactly who did what, and that the logs themselves will be a target.

PCI DSS v4.0.1 breaks this requirement into 7 sections containing 27 individual controls.

What this requirement is actually asking

Logs must be retained for at least 12 months, with the most recent three months immediately available (10.5.1). "Immediately available" means queryable without a restore request.

10.4.1.1 requires automated mechanisms for log review. Manual daily review is no longer sufficient for the critical log sources, which for most entities means a SIEM or equivalent.

10.7 covers failure of the security controls themselves. If logging stops, you must detect that and respond, within 24 hours for service providers.

Does it apply to you?

All system components in scope, plus the security control systems that protect them.

The controls

Requirement 10 contains 27 controls across 7 sections. Each links to its own page with the requirement in full and the testing procedures an assessor uses to verify it.

10.1: Governance for logging and monitoring

Control	What it requires	Guidance
10.1.1	All security policies and operational procedures that are identified in Requirement 10…	Yes
10.1.2	Roles and responsibilities for performing activities in Requirement 10 are documented…	Yes

10.2: What events are logged, and the detail captured per event

Control	What it requires	Guidance
10.2.1	Audit logs are enabled and active for all system components and cardholder data	Yes
10.2.1.1	Audit logs capture all individual user access to cardholder data	Yes
10.2.1.2	Audit logs capture all actions taken by any individual with administrative access…	Yes
10.2.1.3	Audit logs capture all access to audit logs	Yes
10.2.1.4	Audit logs capture all invalid logical access attempts	Yes
10.2.1.5	Audit logs capture all changes to identification and authentication credentials…	Yes
10.2.1.6	Audit logs capture…	Yes
10.2.1.7	Audit logs capture all creation and deletion of system-level objects	Yes
10.2.2	Audit logs record the following details for each auditable event…	Yes

10.3: Protecting logs from alteration and unauthorised access

Control	What it requires	Guidance
10.3.1	Read access to audit logs files is limited to those with a job-related need	Yes
10.3.2	Audit log files are protected to prevent modifications by individuals	Yes
10.3.3	Audit log files, including those for external-facing technologies…	Yes
10.3.4	File integrity monitoring or change-detection mechanisms is used on audit logs to ensure…	Yes

10.4: Reviewing logs, with automation required for critical sources

Control	What it requires	Guidance
10.4.1	The following audit logs are reviewed at least once daily…	Yes
10.4.1.1	Automated mechanisms are used to perform audit log reviews	Yes
10.4.2	Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed…	Yes
10.4.2.1	The frequency of periodic log reviews for all other system components…	Yes
10.4.3	Exceptions and anomalies identified during the review process are addressed	Yes

10.5: Retention: 12 months, 3 months immediately available

Control	What it requires	Guidance
10.5.1	Retain audit log history for at least 12 months, with at least the most recent three months…	Yes

10.6: Time synchronisation, so events can be correlated

Control	What it requires	Guidance
10.6.1	System clocks and time are synchronized using time-synchronization technology	Yes
10.6.2	Systems are configured to the correct and consistent time…	Yes
10.6.3	Time synchronization settings and data are protected…	Yes

10.7: Detecting and responding to failures of security controls

Control	What it requires	Guidance
10.7.1	Service providers: Failures of critical security control systems are detected, alerted, and addressed promptly…	Yes
10.7.2	Failures of critical security control systems are detected, alerted, and addressed promptly…	Yes
10.7.3	Failures of any critical security control systems are responded to promptly…	Yes

Evidence your assessor will ask for

• Log samples showing all the required fields for each event type in 10.2.2
• Configuration showing logs are written to a system the originating admins cannot alter
• Retention configuration plus a successful retrieval from beyond three months
• NTP configuration and evidence of drift monitoring

Where this commonly fails

• Administrators with delete rights on the log store, which defeats 10.3.2
• Retention set to 12 months on the SIEM but 30 days on the source, with nothing in between
• Time sources unsynchronised across cloud regions, making correlation unreliable

Official source

This page is original commentary. It cites requirement identifiers and the official requirement title, and does not reproduce the text of the standard. For the authoritative wording, including each testing procedure and the customized approach objective, download PCI DSS v4.0.1 (June 2024) from the PCI Security Standards Council document library.

PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site.