10.2.1.2Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events

Defined Approach Requirements:

Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.

Defined Approach Testing Procedures:

10.2.1.2 Examine audit log configurations and log data to verify that all actions taken by any individual with administrative access, including any interactive use of application or system accounts, are logged.