10.3 Audit logs are protected from destruction and modification
How to meet it
Restrict and protect logs; forward to a central, tamper-resistant store.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 10.3, in plain English.
10.3.1Read access to audit log files is restricted to those with a job-related need.
10.3.2Audit log files are protected so individuals cannot modify them.
10.3.3Logs, including from external-facing technologies, are promptly backed up to a secure central log server.
10.3.4File integrity monitoring is applied to logs so existing log data cannot change without alerts.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Logging and monitoring policyUse for ISO 27001 A.8.15, A.8.16, A.8.17, SOC 2 Security, and PCI DSS requirements 10 and 11.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map← 10.2 Audit logs are implemented to support anomaly detection10.4 Audit logs are reviewed to identify anomalies →
Back to Requirement 10, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.