10.4.2Audit logs are reviewed to identify anomalies or suspicious activity

Defined Approach Requirements:

Logs of all other system components (those not specified in Requirement 10.4.1) are reviewed periodically.

Defined Approach Testing Procedures:

10.4.2.a Examine security policies and procedures to verify that processes are defined for reviewing logs of all other system components periodically.

10.4.2.b Examine documented results of log reviews and interview personnel to verify that log reviews are performed periodically.