10.5.2 Are audit trail files protected from unauthorized Interview system modifications via access control mechanisms, physical administrators segregation, and/or network segregation? Examine system configurations and permissions 10.5.3 Are audit trail files promptly backed up to a centralized Interview system log server or media that is difficult to alter? administrators Examine system configurations and permissions 10.5.4 Are logs for external-facing technologies (for example, Interview system wireless, firewalls, DNS, mail) written onto a secure, administrators centralized, internal log server or media? Examine system configurations and permissions 10.5.5 Is file-integrity monitoring or change-detection software Examine settings, monitored used on logs to ensure that existing log data cannot be files, and results from changed without generating alerts (although new data monitoring activities being added should not cause an alert)? 10.6 Are logs and security events for all system components reviewed to identify anomalies or suspicious activity as follows? Note: Log harvesting, parsing, and alerting tools may be used to achieve compliance with Requirement 10.6.
10.5.2 Are audit trail files protected from unauthorized modifications via access control mechanisms, physical segregation, and/or network segregation? Interview system administrators Examine system configurations and permissions 10.5.3 Are audit trail files promptly backed up to a centralized log server or media that is difficult to alter? Interview system administrators Examine system configurations and permissions 10.5.4 Are logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) written onto a secure, centralized, internal log server or media? Interview system administrators Examine system configurations and permissions 10.5.5 Is file-integrity monitoring or change-detection software used on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)? Examine settings, monitored files, and results from monitoring activities 10.6 Are logs and security events for all system components reviewed to identify anomalies or suspicious activity as follows? Note: Log harvesting, parsing, and alerting tools may be used to achieve compliance with Requirement 10.6.
SAQ_D.docx