Frequently Asked Question
What is the intent of PCI DSS requirement 10?
The intent of PCI DSS requirement 10 is to ensure organizations have the necessary logs in place to provide an accurate and unaltered record of what has taken place within the cardholder data environment (e.g. who did what, where, when, and how). When properly implemented, audit logs provide invaluable information during forensic reviews following a compromise. Without effective logging, there will be no way to determine what happened, what data was accessed and the length of time that the environment was compromised.
Reviewing logs of critical systems on a daily basis helps organizations identify and address potential compromises, and can significantly reduce the potential exposure from a breach.
Featured FAQ Articles
Most Recently Updated
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?