PCI DSS v4.0/Requirement 10: Log and Monitor All Access to System Components and Cardholder Data/184 of 250
10.4.2.1Audit logs are reviewed to identify anomalies or suspicious activity
Control family: Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
Control description
Defined Approach Requirements:
The frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) is defined in the entity’s targeted risk analysis, which is performed according to all elements specified in Requirement 12.3.1
Defined Approach Testing Procedures:
10.4.2.1.a Examine the entity’s targeted risk analysis for the frequency of periodic log reviews for all other system components (not defined in Requirement 10.4.1) to verify the risk analysis was performed in accordance with all elements specified at Requirement 12.3.1.
10.4.2.1.b Examine documented results of periodic log reviews of all other system components (not defined in Requirement 10.4.1) and interview personnel to verify log reviews are performed at the frequency specified in the entity’s targeted risk analysis performed for this requirement.