SM-04—Audit Logging: Cardholder Data Environment Event Information

>Control Description

Organization records the following information for confirmed events in the cardholder data environment: • user identification • type of event • date and time • event success or failure indication • origination of the event • identification of affected data, system component, or resource

Theme

Technology

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that the below information is being logged for all critical security events: a. user identification b. type of event c. date and time d. event success or failure indication e. origination of the event f. identification of affected data, system component, or resource

>Testing Procedure

1. Inspect SIEM Logs for a sample of in-scope production servers to validate that the below information is being logged for all critical security events: a. user identification b. type of event c. date and time d. event success or failure indication e. origination of the event f. identification of affected data, system component, or resource