Security Event

Applies to. The term does its work in 10.4.1, where all security events head the list of audit logs that must be reviewed at least once daily, ahead of the logs of components that handle cardholder data or sensitive authentication data, critical components and components performing security functions. The standard leaves the entity to decide which entries count: the policies and procedures examined under 10.4.1.a have to say what the organisation treats as a security event, and that decision fixes what the daily review must cover.

Example. A hosting provider's log rules mark as security events any failed login to an administrative account, any change to a firewall rule, any new local account on a server in the card-processing segment, and any alert from the intrusion-detection sensors. Ten failed logins to the database administrator account from a workstation in the finance office become a security event that the morning review has to resolve, even though the eleventh attempt never came.

Limits. A security event is not a security incident: an event is something noticed and reviewed, while an incident under 12.10.1 is a suspected or confirmed security incident that activates the incident response plan, and most events close without becoming one. It is not the same as an audit log entry either: every login is logged, but only the entries the entity's policy defines as security events fall under the first bullet of 10.4.1, though the logs of in-scope components are reviewed daily in any case under its other bullets. A definition so narrow that nothing ever qualifies defeats the purpose of the review.