10.2 Audit logs are implemented to support anomaly detection
How to meet it
Log access, admin actions, and key events with enough detail to investigate.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 10.2, in plain English.
10.2.1Audit logs are enabled and active for all system components and cardholder data.
10.2.1.1Logs record every individual user access to cardholder data.
10.2.1.2Logs record all actions by anyone with administrative access.
10.2.1.3Logs record all access to the audit logs themselves.
10.2.1.4Logs record all invalid logical access attempts.
10.2.1.5Logs record all changes to identification and authentication credentials and privilege changes.
10.2.1.6Logs record initialization of new logs and any starting, stopping, or pausing of logs.
10.2.1.7Logs record all creation and deletion of system-level objects.
10.2.2Each event captures user, event type, date/time, success/failure, origination, and the affected resource.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Logging and monitoring policyUse for ISO 27001 A.8.15, A.8.16, A.8.17, SOC 2 Security, and PCI DSS requirements 10 and 11.Password and authentication policyUse for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.
Open the control-to-policy map← 10.1 Processes and mechanisms are defined and understood10.3 Audit logs are protected from destruction and modification →
Back to Requirement 10, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.