10.7.1Failures of critical security control systems are detected, reported, and responded to promptly

Defined Approach Requirements:

Additional requirement for service providers only:

Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure of the following critical security control systems:

- Network security controls.

- IDS/IPS.

- FIM.

- Anti-malware solutions.

- Physical access controls.

- Logical access controls.

- Audit logging mechanisms.

- Segmentation controls (if used).

Defined Approach Testing Procedures:

10.7.1.a Additional testing procedure for service provider assessments only: Examine documentation to verify that processes are defined for the prompt detection and addressing of failures of critical security control systems, including but not limited to failure of all elements specified in this requirement.

10.7.1.b Additional testing procedure for service provider assessments only: Observe detection and alerting processes and interview personnel to verify that failures of critical security control systems are detected and reported, and that failure of a critical security control results in the generation of an alert.