PCI DSS 10.2.1.2: Audit logs capture all actions taken by any individual with administrative access
PCI DSS v4.0.1 control 10.2.1.2: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 10.2.
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data › Section 10.2
Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.
Summary
Everything an administrator does is logged, including when someone uses an application or system account interactively.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 10.2.1.2 | Examine audit log configurations and log data to verify that all actions taken by any individual with administrative access, including any interactive use of application or system accounts, are logged. |
The clause that carries the weight is the second one: including any interactive use of application or system accounts. Those accounts are the ones with the widest privileges and the least attribution, which is why 8.6.1 permits interactive use only by exception. This control is what makes that exception auditable. If an engineer logs in as the application account to fix something, the actions taken under it have to appear in the log, and the log has to be capable of showing them. The procedure examines configuration and log data, so an entry has to exist.
What to prepare
- The list of accounts with administrative access, human and non-human.
- Log configuration showing administrative actions are captured on each system class.
- Real entries for a recent administrative session, including one performed under a system account if any exists.
- The link to the exception records from 8.6.1, which name who may use those accounts interactively.
How to implement it
1. Log commands, not just logins. A session record showing that an administrator connected satisfies nothing here. Shell auditing, session recording, or a bastion that logs commands is what captures actions.
2. Cover the cloud control plane. Changing a security group or an IAM policy is an administrative action, and it lives in an audit trail separate from the operating-system logs most entities show.
3. Tie interactive service-account use back to a person. Requiring a jump host or a vault checkout for those accounts gives the log a human name alongside the account name.
4. Include database administrators. DBA actions frequently sit outside the general logging pipeline because the database has its own, and being separate is fine as long as it is captured.
Where this commonly fails
- Sessions logged and commands not.
- Interactive use of application accounts unlogged, which is the clause this control adds and the case with the largest blast radius.
- Cloud control-plane activity outside the log pipeline entirely.
- Administrative actions performed through a management console that logs to its own store nobody collects.
Related controls
Others in section 10.2:
| Control | What it requires |
|---|---|
| 10.2.1 | Audit logs are enabled and active for all system components and cardholder data |
| 10.2.1.1 | Audit logs capture all individual user access to cardholder data |
| 10.2.1.3 | Audit logs capture all access to audit logs |
| 10.2.1.4 | Audit logs capture all invalid logical access attempts |
| 10.2.1.5 | Audit logs capture all changes to identification and authentication credentials… |
| 10.2.1.6 | Audit logs capture… |
| 10.2.1.7 | Audit logs capture all creation and deletion of system-level objects |
| 10.2.2 | Audit logs record the following details for each auditable event… |
← 10.2.1.1 · All controls · 10.2.1.3 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.