10.4.3Audit logs are reviewed to identify anomalies or suspicious activity

Defined Approach Requirements:

Exceptions and anomalies identified during the review process are addressed.

Defined Approach Testing Procedures:

10.4.3.a Examine security policies and procedures to verify that processes are defined for addressing exceptions and anomalies identified during the review process.

10.4.3.b Observe processes and interview personnel to verify that, when exceptions and anomalies are identified, they are addressed.