PCI DSS Requirement 10: Logging, Monitoring, Log Retention (10.5.1), and Automated Review (10.4.1.1)

Requirement Structure

Deep Dives

• 10.2.1 / 10.2.1.1-10.2.1.7 - Logs enabled for all system components and cardholder data; capture user CHD access, admin actions (including interactive use of application or system accounts), access to audit logs, invalid access attempts, identification/authentication credential changes, start/stop/pause of audit logs, and create/delete of system-level objects.
• 10.2.2 - Each auditable event records user identification, type of event, date and time, success/failure indication, origination, and identity of affected data, system component, resource, or service.
• 10.3.1-10.3.4 - Read access limited to job-related need; prevent modification by individuals; promptly back up to a secure central log server or media that is difficult to modify; file integrity monitoring or change-detection so existing log data cannot change without generating alerts.
• 10.4.1 - Review at least daily: all security events; logs of components that store, process, or transmit CHD and/or SAD; critical system components; servers and components that perform security functions (for example NSCs, IDS/IPS, authentication servers).
• 10.4.1.1 - Automated mechanisms are used to perform audit log reviews (mandatory since 31 March 2025).
• 10.4.2 / 10.4.2.1 - Logs of all other in-scope system components are reviewed periodically; frequency is defined in the entity's targeted risk analysis per 12.3.1 (10.4.2.1 mandatory since 31 March 2025).
• 10.4.3 - Exceptions and anomalies identified during review are addressed.
• 10.5.1 - Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis.
• 10.6.1-10.6.3 - Synchronize clocks with time-synchronization technology; designated time servers; external time based on International Atomic Time or UTC from industry-accepted sources; protect time settings and data; log, monitor, and review changes to time on critical systems.
• 10.7.2 - Detect, alert, and address failures of critical security control systems (NSCs, IDS/IPS, change-detection, anti-malware, physical and logical access, audit logging, segmentation if used, audit log review mechanisms, automated security testing tools if used). Mandatory for all entities since 31 March 2025 (supersedes service-provider-only 10.7.1).
• 10.7.3 - Respond promptly: restore functions, document duration and cause, remediate issues that arose, prevent recurrence, and resume monitoring.

How CyberSilo Helps

• ThreatHawk SIEM - pre-configured CDE log-source adapters (firewalls, databases, web, POS, cloud), 50+ PCI correlation rules, automated review evidence for 10.4.1 / 10.4.1.1, tiered retention (with optional WORM) for 10.5.1, NTP/UTC sync reporting for 10.6, and critical-control failure alerting for 10.7.2
• Multi-tenant / shared-hosting log separation for service-provider CDEs while keeping a single compliance reporting interface
• GCC multi-regulator evidence mapping - reuse the same SIEM corpus for PCI DSS alongside SAMA CSF / CBUAE / QCB reporting cycles
• Exportable Requirement 10 evidence packages that map log sources and alert rules for QSA review
• Compliance Standards Automation - map Requirement 10 artefacts to continuous evidence

Frequently Asked Questions

Is daily log review Requirement 10.7?

No. Daily review of the 10.4.1 log set is Requirement 10.4.1, with automated mechanisms under 10.4.1.1. Requirement 10.7 covers detection and response when critical security control systems fail.

What does 10.5.1 require for retention?

Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis.

What is 10.4.2.1?

10.4.2.1 is the targeted risk analysis (per 12.3.1) that defines how often you review logs for system components not covered by the daily 10.4.1 set. It is not the time-synchronization control - that is 10.6.

Related PCI Resources

PCI DSS hub · 12 requirements explained · PCI DSS v4.0.1: What Changed · USA v4.0.1 services