Man working on computer

PCI Requirement 10.3.5 – Origination of Event

by Randy Bartels / December 20, 2022

 Where did an Event Begin? When an event occurs, organizations need to know where it came from, so they can trace back to where it happened. PCI Requirement 10.3.5 requires that every log details the origination of event. By doing so, an organization can always identify where an event occurred. Through interviews and observation, auditors will try to verify that the origination of the event is included in log…

PCI Requirement 10.3.4 – Success or Failure Indication

by Randy Bartels / December 20, 2022

 Successful or Not? According to PCI Requirement 10.3.4, every log that’s generated must contain a success or failure indication to demonstrate whether the action that was taken was successful or not. Most applications are pretty good about logging the failed attempts; however, we find that from an assessment perspective, many organizations struggle with the successful events. Through interviews and observation, auditors will try to verify that a success or…

PCI Requirement 10.3.3 – Date and Time

by Randy Bartels / December 20, 2022

 When did an Event Occur? PCI Requirement 10.3 defines what information logs should contain. PCI Requirement 10.3.3, a part of PCI Requirement 10.3, relates to detailing date and time in log entries. To comply with PCI Requirement 10.3.3, every logged event must contain the time and date that the logged event occurred. By doing so, an organization can always identify when an event occurred. Through interviews and observation, auditors…

PCI Requirement 10.3.2 – Type of Event

by Randy Bartels / December 20, 2022

 What Type of Event Occurred? PCI Requirement 10.3 defines what information logs should contain. PCI Requirement 10.3.2, a part of PCI Requirement 10.3, relates to detailing which types of events go into logs. To comply with PCI Requirement 10.3.2, every log that’s generated must contain the type of event that happened during that log event. By doing so, an organization can always identify what type of event occurred and…

PCI Requirement 10.3.1 – User Identification

by Randy Bartels / December 20, 2022

 Who Did What? Where PCI Requirement 10.2 talked about what events should cause a log to be created, PCI Requirement 10.3 defines what information a log should contain. One sub-requirement of PCI Requirement 10.3 relates to user identification in logging. To comply with PCI Requirement 10.3.1, user identification must be included in all log entries. By doing so, an organization can always identify which person performed which action. This…