SM-05—Audit Logging: Service Provider Logging Requirements

>Control Description

Organization establishes unique logging and audit trails for each entity's cardholder data environment and complies with the following: • logs are enabled for third-party applications • logs are active by default • logs are available for review by and communicated to the owning entity

Theme

Technology

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Establish a process that ensures that Organization's audit trails/audit logs: • each and every third-party application for every entity. • logs are active by default 2. Establish a process in the Organization's logging and monitoring mechanism which ensures that logs are reviewed periodically and on a need-to-do basis. Additionally, the same shall be communicated to the concerned stakeholders.

>Testing Procedure

1. Inspect Organization's audit trails/audit logs for: • each and every third-party application for every entity. • logs are active by default 2. Inspect Organization's logging and monitoring mechanism to ensure that logs are reviewed periodically and on a need-to-do basis. Additionally, validate whether the same is being communicated to the concerned stakeholders.