Are written policies and procedures defined for 10.6.1 Review security policies and reviewing the following at least daily, either procedures manually or via log tools? All security events Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) Are the above logs and security events reviewed Observe processes at least daily? Interview personnel Are written policies and procedures defined for 10.6.2 Review security policies and reviewing logs of all other system components procedures periodically—either manually or via log on the organization’s policies and risk management strategy? Are reviews of all system components Review risk assessment performed in accordance with organization’s documentation policies and risk management strategy? Interview personnel Are written policies and procedures defined for 10.6.3 Review security policies and following up on exceptions and anomalies procedures identified during the review process? Is follow up to exceptions and anomalies Observe processes performed? Interview personnel Are audit log retention policies and procedures in 10.7 Review security policies and place and do they require that logs are retained for procedures at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup)?
10.6.1 Are written policies and procedures defined for reviewing the following at least daily, either manually or via log tools? All security events Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) Review security policies and procedures Are the above logs and security events reviewed at least daily? Observe processes Interview personnel 10.6.2 Are written policies and procedures defined for reviewing logs of all other system components periodically—either manually or via log on the organization’s policies and risk management strategy? Review security policies and procedures Are reviews of all system components performed in accordance with organization’s policies and risk management strategy? Review risk assessment documentation Interview personnel 10.6.3 Are written policies and procedures defined for following up on exceptions and anomalies identified during the review process? Review security policies and procedures Is follow up to exceptions and anomalies performed? Observe processes Interview personnel 10.7 Are audit log retention policies and procedures in place and do they require that logs are retained for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup)? Review security policies and procedures
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx