10.2.1.5Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events

Defined Approach Requirements:

Audit logs capture all changes to identification and authentication credentials including, but not limited to:

- Creation of new accounts.

- Elevation of privileges.

- All changes, additions, or deletions to accounts with administrative access.

Defined Approach Testing Procedures:

10.2.1.5 Examine audit log configurations and log data to verify that changes to identification and authentication credentials are captured in accordance with all elements specified in this requirement.