PCI DSS 4.0
Req 10: Logging and Monitoring

PCI DSS 4.0 10.4.1: 10.4.1 Daily review of security-relevant logs

Every day, at a minimum, the entity must review: all security events; the logs of each critical system component; the logs of each system component that stores, processes or transmits CHD and/or SAD; and the logs of each server and system component with a security function (such as authentication servers, IDS/IPS and network security controls). Applies to all entities. Objective under the customized approach: activity that may be suspicious or anomalous is found fast, keeping its impact low.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 54 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

FedRAMP High · 5 controls

  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(3) Correlate Audit Record Repositories
  • AU-7(1) Automatic Processing
  • IR-5 Incident Monitoring
  • SI-4 System Monitoring

FedRAMP Moderate · 5 controls

  • AU-6 Audit Record Review, Analysis, and Reporting
  • AU-6(3) Correlate Audit Record Repositories
  • AU-7(1) Automatic Processing
  • IR-5 Incident Monitoring
  • SI-4 System Monitoring

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities
  • NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools
  • NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis
  • NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

CMMC 2.0 · 4 controls

ISO 27001:2022 · 3 controls

  • 5.36 Compliance with policies, rules and standards for information security
  • 8.15 Logging
  • 8.16 Monitoring activities

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-28 Continuous incident detection and response (Excellent)
  • ASD37-31 Hunt to discover incidents (Very Good)

Azure Security Benchmark · 2 controls

  • ASBv3-LT-1 Enable threat detection capabilities
  • DP-2 Monitor anomalies and threats targeting sensitive data

CIS Controls v8 · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

NIST SP 800-172 · 2 controls

  • 3.11.2e Threat Hunting
  • 3.14.2e Monitor Organizational Systems with Specialized Capabilities

SOC 2 · 2 controls

  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
  • SOC2-CC7.2 CC7.2 Monitoring system components for anomalies

ACSC Essential Eight · 1 control

  • E8-APP-ML2 Application Control (ML2)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

AWS Well-Architected Security Pillar · 1 control

C5 (Germany) · 1 control

  • C5-OPS-13 Logging and Monitoring - Identification of Events

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

HIPAA Security Rule · 1 control

ISO 22301:2019 · 1 control

  • 9.3 Management review

ISO 27002:2022 · 1 control

  • 8.16 Monitoring activities

ISO 27701:2019 · 1 control

  • 6.9.4 Logging and monitoring

ISO/IEC 42001:2023 · 1 control

  • 9.3 Management review

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

  • 03.03.05 Audit Record Review, Analysis, and Reporting

NIST SP 800-66 Rev 2 · 1 control

PCI 3DS Core Security Standard · 1 control

  • P1-7.2.4 P1-7.2.4 Logs and security events monitored or reviewed

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 10: Logging and Monitoring

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 10.4.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 54 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls