10.1 Logging and monitoring processes and roles
Requirement 10.1 asks for current policies and procedures for logging and monitoring all access to system components and cardholder data, and documented roles for log management and review.
Requirement 10 Log and monitor access
Requirement 10 covers audit logging, log protection, review and retention, time synchronization and detection of security control failures. Each page covers one second-level requirement.
10.2 Audit log implementation
Requirement 10.2 defines what audit logs must capture: individual access to cardholder data, administrator actions, access to logs, failed logins, credential changes, log start and stop, system-level objects, and the details for each event.
10.3 Audit log protection
Requirement 10.3 protects audit logs from destruction and tampering: restricted read access, protection from modification, prompt backup to a central server, and file integrity monitoring on the logs themselves.
10.4 Audit log review
Requirement 10.4 requires audit log review: daily review of CDE, critical and security system logs using automated mechanisms, risk-based review frequency for other systems, and follow-up on exceptions.
10.5 Audit log retention
Requirement 10.5 sets audit log retention: at least 12 months of history, with the most recent three months immediately available for analysis.
10.6 Time synchronization
Requirement 10.6 keeps system clocks consistent so logs can be correlated: time-synchronization technology, designated central time servers fed from UTC-based sources, and protected time settings.
10.7 Critical security control failures
Requirement 10.7 requires prompt detection, alerting and response when critical security controls fail, such as NSCs, IDS/IPS, change detection, anti-malware, logging, log review and automated testing tools.
