Monitoring

Applies to. PCI DSS v4.0.1 has no single monitoring requirement; it names the mechanisms that watch and requires their alerts to be acted on. 12.10.5 lists them for the incident response plan: intrusion-detection and prevention systems, network security controls, change-detection mechanisms for critical files (11.5.2), the change- and tamper-detection mechanism for payment pages (11.6.1) and detection of unauthorised wireless access points (11.2.1, which requires alerts to personnel where automated monitoring is used). File integrity monitoring must also cover the audit logs themselves so existing log data cannot change without an alert (10.3.4), and after a critical security control fails, resuming monitoring of security controls is a required step of the response (10.7.3).

Limits. Cadence is set per mechanism, not as continuous observation: critical file comparisons at least weekly (11.5.2), payment page evaluation at least weekly or at a frequency set by targeted risk analysis (11.6.1), wireless detection at least once every three months (11.2.1). The standard does not require round-the-clock human watching.