System-level Object
PCIComplianceHubLast updated
Anything on a system component that the system needs in order to run: application and system executables, configuration files, shared libraries, device drivers and their configuration, and third-party components. The term exists so that Requirement 10 can say what an audit log must record the creation and deletion of.
Applies to. Every in-scope system component, through the logging control 10.2.1.7 and the change-detection control 11.5.2.
Example. A new scheduled task appears on a payment server, a DLL is replaced, a kernel driver is added. Each is the creation or deletion of a system-level object, and 10.2.1.7 requires the audit log to record it, because that is what an intruder establishing persistence looks like.
Limits. The definition is broad on purpose and the log volume that follows is real; the control is about capturing the events, and 10.4.1 about reviewing them daily on critical systems. File integrity monitoring under 11.5.2 watches the same objects from the other side, alerting on unauthorised modification of critical files, and the two together are how a change nobody made gets noticed.