PCI DSS 4.0
Req 10: Logging and Monitoring

PCI DSS 4.0 10.2.1: 10.2.1 Audit logging enabled on all system components

Audit logging must be switched on and actively recording for every system component and for cardholder data. Applies to all entities. The guidance explains that logs feed alerts and other monitoring tools such as IDS and SIEM and give a history trail for investigating incidents, and it advises storing only essential information in logs because log content is itself sensitive. Customized approach objective: every activity affecting system components and cardholder data leaves a record.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 75 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 15 controls

  • AC-17(1) Monitoring and Control
  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-1 Policy and Procedures
  • AU-12 Audit Record Generation
  • AU-2 Event Logging
  • AU-6(3) Correlate Audit Record Repositories
  • AU-7(1) Automatic Processing
  • CM-3 Configuration Change Control
  • IR-5 Incident Monitoring
  • MA-4 Nonlocal Maintenance
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SI-4 System Monitoring
  • SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
  • SI-7(7) Integration of Detection and Response

FedRAMP Moderate · 15 controls

  • AC-17(1) Monitoring and Control
  • AC-2(12) Account Monitoring for Atypical Usage
  • AU-1 Policy and Procedures
  • AU-12 Audit Record Generation
  • AU-2 Event Logging
  • AU-6(3) Correlate Audit Record Repositories
  • AU-7(1) Automatic Processing
  • CM-3 Configuration Change Control
  • IR-5 Incident Monitoring
  • MA-4 Nonlocal Maintenance
  • SA-1 Policy and Procedures
  • SA-5 System Documentation
  • SI-4 System Monitoring
  • SI-4(16) System Monitoring | Correlate Monitoring Information (SI-4(16))
  • SI-7(7) Integration of Detection and Response

ISO 27701:2019 · 5 controls

  • 6.10.2 Information transfer
  • 6.9 Operations security
  • 6.9.4 Logging and monitoring
  • 7.2.8 Records related to processing PII
  • 7.4.3 Accuracy and quality

SOC 2 · 5 controls

  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
  • SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
  • SOC2-PI1.1 PI1.1 Quality information about processing objectives, data definitions and specifications
  • SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs

NIST SP 800-53 Rev 5 · 4 controls

CMMC 2.0 · 3 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway
  • ANSSI-HYG-36 Enable and Configure Logging on the Most Important Components

C5 (Germany) · 2 controls

  • C5-OPS-10 Logging and Monitoring - Concept
  • C5-OPS-13 Logging and Monitoring - Identification of Events

CIS Controls v8 · 2 controls

  • CIS-16.11 Leverage Vetted Modules or Services for Application Security Components
  • CIS-8.2 Collect Audit Logs

ISO 27001:2022 · 2 controls

ISO 27002:2022 · 2 controls

ISO/IEC 42001:2023 · 2 controls

  • 7.5 Documented information
  • 7.5.3 Control of documented information

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.PS-04 Log records are generated and made available for continuous monitoring
  • NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved

NIST SP 800-171 Rev 3 · 2 controls

APPI · 1 control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-33 Capture network traffic (Limited)

AWS Well-Architected Security Pillar · 1 control

  • SEC04-BP01 Configure service and application logging

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Azure Security Benchmark · 1 control

  • LT-3 Enable logging for security investigation

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

HIPAA Security Rule · 1 control

NIST SP 800-66 Rev 2 · 1 control

PCI 3DS Core Security Standard · 1 control

  • P1-7.2.2 P1-7.2.2 Logs tie access to individuals and record security events

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 10: Logging and Monitoring

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 10.2.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 75 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls