10.1 Processes and mechanisms are defined and understood
How to meet it
Document logging and monitoring policy.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 10.1, in plain English.
10.1.1All security policies and operational procedures for Requirement 10 are documented, kept current, in use, and known to everyone they affect.
10.1.2Roles and responsibilities for carrying out Requirement 10 activities are documented, assigned, and understood.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.Logging and monitoring policyUse for ISO 27001 A.8.15, A.8.16, A.8.17, SOC 2 Security, and PCI DSS requirements 10 and 11.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.
Open the control-to-policy mapBack to Requirement 10, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.