What it asks for. Requirement 10 of PCI DSS v4.0 covers audit logging and monitoring. It requires logs that capture user activity and security relevant events in sufficient detail, protection of logs against tampering, regular review of logs, retention for a defined period, time synchronisation and prompt detection and response to failures of critical security control systems.
In practice. Organisations collect logs centrally, protect their integrity, synchronise clocks and use automated mechanisms to review logs and alert on suspicious activity, which v4.0 now expects. Evidence includes logging configuration, retention settings, review records, alert handling and records of control failures and how they were addressed.
Common gaps. Logs are often collected but not reviewed in a meaningful way. Failures of security controls, such as a logging agent stopping, can go unnoticed for long periods.