FAQ #1033 Diff

PCI DSS requirement 10.2.5 requires organizations to log the use of and changes to identification and authentication mechanisms, which are typically used by administrators. These mechanisms include (but are not limited to activities such as: 1. Adding and deleting user IDs; 2. Assigning user IDs to tokens; and, 3. Adding and deleting tokens. These mechanisms include activities such as creation of new accounts and elevation of privileges, and all changes, additions, or deletions to accounts with root or administrative access.

PCI DSS requirement 10.2.6 requires organizations to log each instance where the audit log is initialized (startedor stopped)), stopped, or paused, to ensure a malicious user is not covering his/her actions or events by stopping or starting logginginterfering with logging functions.