What Requirement 10 actually requires
Log everything in scope (10.2)
Audit logs must be on for every system component in the cardholder data environment and must capture specific events: every access to cardholder data, every action by an administrator, every access to the logs themselves, failed login attempts, changes to accounts and credentials, logs being started, stopped or paused, and system-level objects being created or deleted. Each entry has to record who, what, when, where and the outcome.
Protect the logs (10.3)
Only people with a job-related need can read the logs, nobody can alter them, they are backed up promptly to a central log server, and file integrity monitoring or change detection alerts if existing log data is changed.
Review them every day (10.4)
Security events, logs from systems that store, process or transmit cardholder data, logs from critical systems and from systems that perform security functions must be reviewed at least once a day. Since 31 March 2025 that review must use automated mechanisms (10.4.1.1). Anything unusual has to be followed up and resolved, not just noted.
Keep a year of history (10.5)
At least 12 months of audit log history, with at least the most recent three months immediately available for analysis.
Keep the clocks right (10.6)
Every system uses synchronized time from a reliable source so events can be lined up across systems during an investigation.
Notice when a control fails (10.7)
Failures of critical security controls, including firewalls, intrusion detection, anti-malware, access controls, the logging itself and the log review process, must be detected, alerted on and dealt with promptly. As of 31 March 2025 this applies to all entities, not only service providers.
Requirement 11.5 comes along with it
Requirement 10 is about seeing what happened. Requirement 11.5 is about catching intrusions and unauthorized changes as they happen. Assessors look at the two together, and the same platform usually covers both.
Intrusion detection and prevention (11.5.1)
Intrusion detection or prevention techniques must watch all traffic at the perimeter of the cardholder data environment and at critical points inside it, alert on suspected compromises, and be kept current.
Change detection (11.5.2)
A change-detection mechanism such as file integrity monitoring must alert on unauthorized changes to critical system files, configuration files and content files, with comparisons at least weekly.
Which SAQs include Requirement 10
Not every self-assessment questionnaire includes the full requirement. The table is a guide; confirm your SAQ with our PCI SAQ Finder.
| Who you are | SAQ | Requirement 10 and 11.5 scope |
|---|---|---|
| Merchant with all card data handled by a validated third party, website redirects or iframes | SAQ A | Minimal; logging requirements largely fall on your provider |
| E-commerce merchant whose website affects the payment page | SAQ A-EP | Partial; logging, log review and retention for the systems that touch the payment page |
| Merchant with a payment application connected to the internet | SAQ C | Partial; logging and review for the in-scope payment systems |
| Merchant that does not fit a shorter SAQ, or any service provider | SAQ D | Full Requirement 10 and 11.5 |
| Any organization assessed by a QSA for a Report on Compliance | ROC | Full Requirement 10 and 11.5 |
How Managed SOC + SIEM covers it
We sell one service, Managed SOC + SIEM. Here is how it maps to the requirement, line by line.
Logging (10.2)
The SIEM collects logs from your in-scope systems, including syslog from network devices, agents on servers and workstations, and API connections to your cloud, identity and security tools, into one place with every event stamped with who, what, when and where.
Protection (10.3)
Logs are stored centrally on your SIEM, hosted in our data centers in Philadelphia, Athens or Limassol, or deployed in your own environment, encrypted in transit and protected from modification.
Daily and automated review (10.4)
Detection rules check your logs continuously, which satisfies the automated review mechanism the standard now requires, and Clone Systems analysts in the United States and the EU work the incident queue 24/7, so exceptions are investigated and resolved rather than filed.
Retention (10.5)
Retention is set to meet the 12 months of history and three months immediately available that PCI DSS requires, and can be set longer if another framework needs it.
Control failure detection (10.7)
A quiet-source rule set for each monitored control raises an alert when it stops reporting, and a log source health report lists anything that has gone silent, so the SOC knows when a control fails.
Intrusion detection (11.5.1)
Inline intrusion prevention is available as a managed service alongside the SOC, with alerts correlated in the same SIEM.
Change detection (11.5.2)
File changes on monitored endpoints flow into the SIEM, so unauthorized changes to critical files are alerted on and investigated.
Evidence for your assessor
Scheduled reports aligned to PCI DSS, delivered as PDF or Excel, give your QSA or your SAQ the review evidence, retention evidence and incident history in one place.
How to decide
- You are on SAQ A. You probably do not need this page. Keep your quarterly ASV scans current.
- You are on SAQ A-EP or SAQ C and someone reviews logs by hand. Since March 2025 the review has to be automated. Managed SOC + SIEM covers it, and the 50 endpoint minimum is the thing to check first.
- You are on SAQ D or going through a ROC. Requirement 10 and 11.5 apply in full. This is the service built for you.
- You are a service provider. You also carry the control-failure detection requirement, which the SOC handles as part of normal monitoring.
- Your logs cannot leave your environment. Self-host the SIEM with us managing it. The analysts and the AI work the same way.
What it costs, in structure
Managed SOC + SIEM is priced per monitored endpoint with a 50 endpoint minimum, on a one-year term with multi-year available. The SIEM, the analysts and the private AI are included. It is sold directly through a scoping call and demo, not online.