PCI-DSS Requirement 10 — Log and Monitor All Access to System Components
Enforced by: PCI SSC
Current as of March 31, 2022
Plain Language Summary
Log everything in the CDE. Protect logs from modification. Retain for 12 months with 3 months immediately available. Implement real-time alerting for suspicious activity.
Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. Audit logs must capture: user identification, type of event, date and time, success or failure indication, origination of event, and identity of affected data or system component. Audit logs must be protected from modification, retained for 12 months with at least 3 months immediately available for analysis.