TL;DR
- PCI DSS Requirement 10 requires organizations to log, protect, review, and retain audit records for every in-scope system, with 12 months of history and three months immediately available.
- Since March 31, 2025, daily log reviews must be automated (10.4.1.1), periodic review frequencies need a targeted risk analysis (10.4.2.1), and all entities must detect critical security control failures (10.7.2).
- Assessors look for operating evidence across the full year, such as review tickets, alert records, and failure responses. Written policies alone don’t satisfy them.
PCI DSS Requirement 10 requires organizations to generate, protect, review, and retain audit logs for every system component in or connected to the CDE, so suspicious activity can be detected and investigated.
The v4.0.1 requirement, titled “Log and Monitor All Access to System Components and Cardholder Data,” has seven sections:
| Section | Focus | What It Means in Practice |
| 10.1 | Governance | Documented policies, procedures, and roles |
| 10.2 | Log generation | Capture defined events with enough detail |
| 10.3 | Log protection | Prevent unauthorized access or changes to logs |
| 10.4 | Log review | Identify anomalies and act on exceptions |
| 10.5 | Retention | 12 months of history, three months immediately available |
| 10.6 | Time synchronization | Consistent, accurate system clocks |
| 10.7 | Control failures | Detect and respond to failed security controls |
PCI DSS v4.0.1 is the only active version, and its future-dated Requirement 10 items became mandatory on March 31, 2025. The PCI Security Standards Council’s mid-2026 request for comments does not change current assessment requirements.
Which Events Must Be Logged Under Requirement 10?
Requirement 10.2.1 requires audit logs to be enabled for all system components and cardholder data, and 10.2.1.1 through 10.2.1.7 list the events to capture:
- All individual user access to cardholder data.
- All actions by individuals with administrative access, including interactive use of system accounts.
- All access to audit logs.
- Invalid logical access attempts.
- Changes to identification and authentication credentials, including new accounts and privilege elevation.
- Initialization, stopping, or pausing of audit logs.
- Creation and deletion of system-level objects.
What Details Should Each Log Entry Contain?
Requirement 10.2.2 requires every logged event to record six details: user identification, type of event, date and time, success or failure indication, origination of the event, and the identity of the affected data, system component, resource, or service. Without them, investigators cannot reliably attribute an action.
How Should Audit Logs Be Protected and Retained?
Audit logs must be protected from unauthorized access and changes, backed up centrally, monitored for changes, and retained for at least 12 months.
Log Protection Under Requirement 10.3
- 10.3.1: Limit read access to audit log files to those with a job-related need.
- 10.3.2: Protect log files from modification by individuals.
- 10.3.3: Back up logs, including those from external-facing technologies, promptly to a secure, central, internal log server or other media that is difficult to modify.
- 10.3.4: Use file integrity monitoring or change-detection mechanisms on audit logs so that changes to existing log data generate alerts.
As a hypothetical example, an attacker with administrative rights on a web server can delete local logs, but copies already forwarded to a write-protected central server survive.
Log Retention Under Requirement 10.5.1
PCI DSS log retention requires at least 12 months of audit log history, with the most recent three months immediately available for analysis. Older logs can sit in archive storage if they can be restored when needed.
How Often Must PCI DSS Logs Be Reviewed?
PCI DSS Requirement 10.4.1 requires daily review of security events and of logs from CDE systems, critical system components, and systems that perform security functions. Since March 31, 2025, Requirement 10.4.1.1 also requires automated mechanisms to perform those reviews.
The daily review scope includes:
- All security events.
- Logs of system components that store, process, or transmit cardholder data or sensitive authentication data.
- Logs of all critical system components.
- Logs of components performing security functions, such as network security controls, IDS/IPS, and authentication servers.
Other system components can be reviewed periodically under 10.4.2, at a frequency set through a targeted risk analysis under 10.4.2.1 and Requirement 12.3.1. Requirement 10.4.3 requires exceptions and anomalies to be addressed.
PCI DSS does not name a tool, but a security information and event management (SIEM) platform or managed detection service usually performs this function, since manual review rarely meets the automated expectation.
Our guide to building a PCI DSS audit trail that passes covers log architecture in more detail.
Why Do Time Synchronization and Control Failure Detection Matter?
Time synchronization puts events from different systems in the correct order, and control failure detection prevents a broken security tool from leaving the CDE silently unmonitored.
Time Synchronization Under Requirement 10.6
Requirements 10.6.1 through 10.6.3 require synchronized clocks, designated central time servers that take time from industry-accepted sources based on International Atomic Time or UTC, and protected time settings.
Detecting Critical Security Control Failures Under Requirement 10.7
Since March 31, 2025, Requirement 10.7.2 applies to all entities, where it previously covered only service providers. It requires prompt detection, alerting, and handling of failures in critical security control systems, including:
- Network security controls, IDS/IPS, and anti-malware
- Change-detection mechanisms and access controls
- Audit logging and log review mechanisms
- Segmentation controls and automated security testing tools, where used
Requirement 10.7.3 requires a documented response: restoring functions, recording the failure’s duration and cause, addressing resulting security issues, and preventing recurrence.
What Evidence Do QSAs Expect for Requirement 10?
Qualified Security Assessors (QSAs) expect evidence that logging is configured, operating, reviewed, and acted on across the full assessment period, including:
- Logging policies, procedures, and assigned roles
- System configurations showing audit logging enabled for required event types
- Sample log entries showing all six 10.2.2 data elements
- Log repository access controls and file integrity monitoring settings
- SIEM correlation rules, alert records, and daily review records or tickets
- Retention settings, archive restoration tests, and time server configurations
- The targeted risk analysis supporting periodic review frequencies
- Records of security control failures and the response to each
A review procedure with no tickets or alerts behind it suggests the process exists only on paper. A PCI QSA will typically sample evidence from across the full year.
What Are the Most Common Requirement 10 Gaps?
The most common gaps involve incomplete log sources, reviews without evidence, and missing detection of security control failures.
- In-scope cloud services, containers, and SaaS platforms not forwarding logs centrally
- Administrative actions through shared accounts that cannot be traced to an individual
- SIEM alerts that are never triaged or documented
- Periodic review frequencies set without a targeted risk analysis
- Log forwarders failing silently for days
- Inconsistent time sources, or less than three months of logs immediately searchable
Untraceable administrative activity often reflects weaknesses in PCI DSS Requirement 8 authentication controls, and coverage gaps usually trace back to an inaccurate system inventory.
How Can Organizations Strengthen Requirement 10 Compliance?
Confirm every in-scope system sends complete logs to a protected central platform, then automate review and treat logging failures as security incidents.
- Map every in-scope system and confirm it forwards logs centrally.
- Validate required event types and data elements.
- Automate daily review with defined correlation rules and documented triage.
- Complete a targeted risk analysis for periodic review of non-critical systems.
- Alert on failures of logging agents, security tools, and time sources.
- Test log restoration and retention settings.
- Keep review records and tickets as continuous evidence.
If an internal review surfaces these gaps, an independent assessment before the formal audit reduces surprises. Ampcus Cyber’s PCI DSS compliance services include gap assessments that test Requirement 10 controls against v4.0.1, followed by remediation guidance and QSA assessment support.
Turning PCI DSS Requirement 10 Into Continuous Detection
PCI DSS Requirement 10 is where compliance and security operations meet. Complete, protected, synchronized, and reviewed logs give assessors their evidence and give security teams the visibility to detect an intrusion early. With automated review and control failure detection now mandatory, Requirement 10 works best as a continuous monitoring capability that operates every day.
| Book a PCI DSS readiness assessment to find your Requirement 10 gaps. Ampcus Cyber’s PCI DSS gap assessment tests your log coverage, automated review, retention, and control failure detection against v4.0.1, then gives you a prioritized remediation plan. |
People Also Ask
How long must audit logs be retained under PCI DSS Requirement 10?
PCI DSS Requirement 10.5.1 requires organizations to retain audit log history for at least 12 months, with the most recent three months immediately available for analysis. Older logs may be archived, provided they remain retrievable when required.
Does PCI DSS Requirement 10 require a SIEM solution?
No. PCI DSS does not explicitly mandate a Security Information and Event Management (SIEM) solution. However, Requirement 10.4.1.1 requires automated mechanisms for reviewing specified audit logs. Organizations can use a SIEM or other suitable automated solutions that meet the requirement.
Do all PCI DSS audit logs need to be reviewed daily?
No. Requirement 10.4.1 mandates daily reviews of security events and logs from systems handling account data, critical system components, and systems performing security functions. Other in-scope logs may be reviewed periodically, with the frequency defined through a targeted risk analysis.
What events must be logged under PCI DSS Requirement 10?
Requirement 10.2.1 covers events such as individual access to cardholder data, administrative actions, access to audit logs, invalid access attempts, changes to identification and authentication credentials, logging initialization or interruption, and creation or deletion of system-level objects. Each recorded event must contain the applicable details specified in Requirement 10.2.2.
What evidence is required for a PCI DSS Requirement 10 audit?
Assessors may examine audit log samples, logging configurations, retention settings, automated review mechanisms, documented review procedures, evidence of anomaly follow-up, and time-synchronization controls. Organizations must demonstrate that the applicable logging and monitoring requirements are implemented and operating effectively.
Is automated log monitoring mandatory under PCI DSS v4.0.1?
Yes. Requirement 10.4.1.1 requires automated mechanisms for the audit log reviews specified in Requirement 10.4.1. This requirement became effective on March 31, 2025. Automated reviews must support the identification of anomalies and suspicious activity, with identified exceptions addressed under the applicable review procedures.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
