10.5.5 Is file-integrity monitoring or change-detection software Examine settings, monitored files, and used on logs to ensure that existing log data cannot be results from monitoring activities changed without generating alerts (although new data being added should not cause an alert)? 10.6 Are logs and security events for all system components reviewed to identify anomalies or suspicious activity as follows? Note: Log harvesting, parsing, and alerting tools may be used to achieve compliance with Requirement 10.6. (b) Are the following logs and security events 10.6.1 Review security policies and reviewed at least daily, either manually or via log procedures tools? Observe processes All security events Interview personnel Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection prevention systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) (b) Are logs of all other system components 10.6.2 Review security policies and periodically reviewed—either manually or via log procedures tools—based on the organization’s policies and Review risk assessment risk management strategy? documentation Interview personnel (b) Is follow up to exceptions and anomalies identified 10.6.3 Review security policies and during the review process performed? procedures Observe processes Interview personnel
10.5.5 Is file-integrity monitoring or change-detection software used on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)? Examine settings, monitored files, and results from monitoring activities 10.6 Are logs and security events for all system components reviewed to identify anomalies or suspicious activity as follows? Note: Log harvesting, parsing, and alerting tools may be used to achieve compliance with Requirement 10.6. 10.6.1 (b) Are the following logs and security events reviewed at least daily, either manually or via log tools? All security events Logs of all system components that store, process, or transmit CHD and/or SAD Logs of all critical system components Logs of all servers and system components that perform security functions (for example, firewalls, intrusion-detection systems (IDS/IPS), authentication servers, e-commerce redirection servers, etc.) Review security policies and procedures Observe processes Interview personnel 10.6.2 (b) Are logs of all other system components periodically reviewed—either manually or via log tools—based on the organization’s policies and risk management strategy? Review security policies and procedures Review risk assessment documentation Interview personnel 10.6.3 (b) Is follow up to exceptions and anomalies identified during the review process performed? Review security policies and procedures Observe processes Interview personnel prevention
PCI-DSS-v3_2-SAQ-A_EP.docx