10.4.1 Daily review of security-relevant logs
Every day, at a minimum, the entity must review: all security events; the logs of each critical system component; the logs of each system component that stores, processes or transmits CHD and/or SAD; and the logs of each server and system component with a security function (such as authentication servers, IDS/IPS and network security controls). Applies to all entities. Objective under the customized approach: activity that may be suspicious or anomalous is found fast, keeping its impact low.
Source: PCI DSS v4.0.1, 10.4.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Daily log review procedure naming the four log categories · SIEM / log platform
- SIEM dashboards or review tickets showing a review for every calendar day, including weekends and holidays · SIEM / log platform
periodic reviewEvidence produced at each review
- Reports or sign-offs from an outsourced SOC, if used · SIEM / log platform
- Interview records with analysts performing the review · SIEM / log platform
governing documentDocuments that govern the control
- List of critical system components and security function systems covered by review · Policy repository / GRC workspace
First move
Common gaps auditors find
- No review evidence for weekends or public holidays
- Security function devices such as authentication servers not included in the review scope
- Reliance on alerts only, with no defined review of the listed logs
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet10.3.4 File integrity monitoring on audit logs · 10.4.1.1 Automated mechanisms used for audit log review