10.4.2 Periodic review of all other system component logs

Logs from every other in-scope system component, meaning those not covered by the daily review in 10.4.1, must be reviewed on a periodic basis. Applies to all entities. Applicability: covers every remaining in-scope component outside the scope of 10.4.1. The guidance notes these reviews can reveal signs of trouble or attempts to reach critical systems by way of less critical ones. Customized approach objective: suspicious or anomalous activity on these other components is reviewed in line with the risk the entity has identified.

Source: PCI DSS v4.0.1, 10.4.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.