Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
PCI DSS v4.0.1 Requirement 10: what to log, protecting logs from tampering, the 12-month retention rule and automated log review.
PCIComplianceHubLast updated Last reviewed against PCI DSS v4.0.1
Requirement 10 is what makes an incident investigable. Its controls assume that one day you will need to reconstruct exactly who did what, and that the logs themselves will be a target.
PCI DSS v4.0.1 breaks this requirement into 7 sections containing 27 individual controls.
What this requirement is actually asking
Logs must be retained for at least 12 months, with the most recent three months immediately available (10.5.1). "Immediately available" means ready for analysis without delay. The standard gives storing logs online, archiving them, or restoring them quickly from backups as ways to achieve it.
10.4.1.1 requires automated mechanisms for log review. Manual review on its own no longer meets the daily review in 10.4.1. The standard gives log harvesting, parsing and alerting tools, central log management systems, event log analysers and SIEM products as examples.
10.7 covers failure of the security controls themselves. If logging stops, or another critical security control system fails, every entity must detect, alert on and address the failure promptly (10.7.2) and respond to it promptly (10.7.3). The standard sets no fixed number of hours.
Does it apply to you?
All system components in scope, plus the security control systems that protect them. The logging covers activity by employees, contractors, vendors and other third parties, not the activity of consumers (cardholders).
The controls
Requirement 10 contains 27 controls across 7 sections. Each links to its own page with the requirement in full and the testing procedures an assessor uses to verify it.
10.1: Governance for logging and monitoring
| Control | What it requires | Guidance |
|---|---|---|
| 10.1.1 | All security policies and operational procedures that are identified in Requirement 10… | Yes |
| 10.1.2 | Roles and responsibilities for performing activities in Requirement 10 are documented… | Yes |
10.2: What events are logged, and the detail captured per event
| Control | What it requires | Guidance |
|---|---|---|
| 10.2.1 | Audit logs are enabled and active for all system components and cardholder data | Yes |
| 10.2.1.1 | Audit logs capture all individual user access to cardholder data | Yes |
| 10.2.1.2 | Audit logs capture all actions taken by any individual with administrative access… | Yes |
| 10.2.1.3 | Audit logs capture all access to audit logs | Yes |
| 10.2.1.4 | Audit logs capture all invalid logical access attempts | Yes |
| 10.2.1.5 | Audit logs capture all changes to identification and authentication credentials… | Yes |
| 10.2.1.6 | Audit logs capture… | Yes |
| 10.2.1.7 | Audit logs capture all creation and deletion of system-level objects | Yes |
| 10.2.2 | Audit logs record the following details for each auditable event… | Yes |
10.3: Protecting logs from alteration and unauthorised access
| Control | What it requires | Guidance |
|---|---|---|
| 10.3.1 | Read access to audit logs files is limited to those with a job-related need | Yes |
| 10.3.2 | Audit log files are protected to prevent modifications by individuals | Yes |
| 10.3.3 | Audit log files, including those for external-facing technologies… | Yes |
| 10.3.4 | File integrity monitoring or change-detection mechanisms is used on audit logs to ensure… | Yes |
10.4: Daily automated log review, and risk-based review of the rest
| Control | What it requires | Guidance |
|---|---|---|
| 10.4.1 | The following audit logs are reviewed at least once daily… | Yes |
| 10.4.1.1 | Automated mechanisms are used to perform audit log reviews | Yes |
| 10.4.2 | Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed… | Yes |
| 10.4.2.1 | The frequency of periodic log reviews for all other system components… | Yes |
| 10.4.3 | Exceptions and anomalies identified during the review process are addressed | Yes |
10.5: Retention: 12 months, 3 months immediately available
| Control | What it requires | Guidance |
|---|---|---|
| 10.5.1 | Retain audit log history for at least 12 months, with at least the most recent three months… | Yes |
10.6: Time synchronisation, so events can be correlated
| Control | What it requires | Guidance |
|---|---|---|
| 10.6.1 | System clocks and time are synchronized using time-synchronization technology | Yes |
| 10.6.2 | Systems are configured to the correct and consistent time… | Yes |
| 10.6.3 | Time synchronization settings and data are protected… | Yes |
10.7: Detecting and responding to failures of security controls
| Control | What it requires | Guidance |
|---|---|---|
| 10.7.1 | Service providers: Failures of critical security control systems are detected, alerted, and addressed promptly… | Yes |
| 10.7.2 | Failures of critical security control systems are detected, alerted, and addressed promptly… | Yes |
| 10.7.3 | Failures of any critical security control systems are responded to promptly… | Yes |
Evidence your assessor will ask for
- Log samples showing all the required fields for each event type in 10.2.2
- Configuration showing logs are written to a system the originating admins cannot alter
- Retention configuration plus a successful retrieval from beyond three months
- NTP configuration and evidence of drift monitoring
Where this commonly fails
- Administrators with delete rights on the log store, which defeats 10.3.2
- Sources that keep 30 days of logs locally and were never connected to the SIEM, so their history is lost after a month
- Time sources unsynchronised across cloud regions, making correlation unreliable
Terms
Glossary entries that name a control in this requirement:
- Administrative Access: 10.2.1.2
- Anti-Malware: 10.7.2
- Application and System Accounts: 10.2.1.2
- Audit Log / Audit Trail: 10.2.1, 10.2.2, 10.3.1, 10.3.3, 10.3.4, 10.4.1, 10.5.1, 10.7.2
- Automated Log Review: 10.4.1, 10.4.1.1, 10.7.2
- Backup: 10.3.3
- Critical Systems: 10.4.1
- File Integrity Monitoring: 10.3.4, 10.7.1, 10.7.2
- Forensics: 10.5.1
- Interactive Login: 10.2.1.2
- Intrusion Detection System (IDS): 10.4.1, 10.7.2
- Intrusion Prevention System (IPS): 10.4.1, 10.7.2
- Logging: 10.7.1, 10.7.2
- Logical Access Control: 10.7.1, 10.7.2
- Monitoring: 10.3.4, 10.7.3
- NTP (Network Time Protocol): 10.6.1, 10.6.2
- Security Event: 10.4.1
- System-level Object: 10.2.1.7
- User Identification: 10.2.2
Official source
The commentary on this page is our own. The requirement title, and the control text in the tables above (shortened where it ends in an ellipsis), are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. Each control's own page carries its requirement text in full. For the authoritative wording, including each testing procedure and the customized approach objective, download the standard from the PCI Security Standards Council document library.
PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site.