PCI DSS v4.0/Requirement 10: Log and Monitor All Access to System Components and Cardholder Data/179 of 250
10.3.3Audit logs are protected from destruction and unauthorized modifications
Control family: Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
Control description
Defined Approach Requirements:
Audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.
Defined Approach Testing Procedures:
10.3.3 Examine backup configurations or log files to verify that current audit log files, including those for external-facing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.