PCI DSS 10.2.1: Audit logs are enabled and active for all system components and cardholder data
PCI DSS v4.0.1 control 10.2.1: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 10.2.
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data › Section 10.2
Audit logs are enabled and active for all system components and cardholder data.
Summary
Audit logging is turned on and actually running everywhere it needs to be.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 10.2.1 | Interview the system administrator and examine system configurations to verify that audit logs are enabled and active for all system components. |
The base of Requirement 10: every other logging control assumes the logs exist. The single procedure examines system configurations to verify audit logs are enabled and active for all system components, which makes this a configuration check rather than a policy one, and the wording matters twice. Enabled and active means a logging subsystem configured but stopped fails. All system components means the scope is the inventory, so a component nobody listed is a component nobody checked. The sub-controls beneath this one define what each log entry must contain; this one is only about whether logging is happening at all, and it is a surprisingly common gap.
What to prepare
- The system component inventory, which defines the scope of this control.
- Configuration evidence per component type showing logging enabled.
- Evidence logs are being produced now, not merely configured: recent entries from each source.
- Coverage evidence for components that log to a central collector, showing they are still reporting.
How to implement it
1. Check for recent entries, not for configuration. A logging agent that stopped three weeks ago still looks correctly configured. The cheap version of this control is an alert when a source goes quiet.
2. Derive scope from the inventory. Databases, network devices, hypervisors and the security tooling itself are all system components, and the last is often missed because it is where the logs go.
3. Cover ephemeral components explicitly. Containers and instances that live for hours must ship logs off before they are gone, or the evidence disappears with them.
4. Do not conflate this with review. Enabling logs is this control; reading them daily is 10.4.1; keeping them is 10.5.1. They fail independently.
Where this commonly fails
- A log source that silently stopped, with nothing watching for absence.
- Logging enabled on servers and omitted on the network devices and the hypervisor.
- Containers logging to their own filesystem, which vanishes with the container.
- Scope taken from a stale inventory, so recently provisioned components were never in it.
Related controls
Others in section 10.2:
| Control | What it requires |
|---|---|
| 10.2.1.1 | Audit logs capture all individual user access to cardholder data |
| 10.2.1.2 | Audit logs capture all actions taken by any individual with administrative access… |
| 10.2.1.3 | Audit logs capture all access to audit logs |
| 10.2.1.4 | Audit logs capture all invalid logical access attempts |
| 10.2.1.5 | Audit logs capture all changes to identification and authentication credentials… |
| 10.2.1.6 | Audit logs capture… |
| 10.2.1.7 | Audit logs capture all creation and deletion of system-level objects |
| 10.2.2 | Audit logs record the following details for each auditable event… |
← 10.1.2 · All controls · 10.2.1.1 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.