What does Requirement 10.1 require regarding audit trails?

What does Requirement 10.1 require regarding audit trails?

• A. To store audit trails off-site.
• B. To link all access to system components to each individual user.
• C. To limit audit trails to login events only.
• D. To generate audit trails only for privileged users.

Answer: (B)

The key idea is accountability through audit trails: every action on system components must be identifiable as having been performed by a specific user. Requirement 10.1 focuses on establishing audit trails that tie all access to system components to each individual user, so you can trace who did what, when, and from where. This enables effective monitoring, detection of inappropriate activity, and a solid basis for investigations or forensic analysis. Storing logs off-site isn’t a stated mandate of this requirement, though secure protection and proper retention are important. Limiting audit trails to login events would miss critical activities like data access, changes, or other actions that impact security. Generating logs only for privileged users ignores the risk presented by regular users who could misuse access or be compromised. So the emphasis is on linking all access and actions to the exact user responsible.

The key idea is accountability through audit trails: every action on system components must be identifiable as having been performed by a specific user. Requirement 10.1 focuses on establishing audit trails that tie all access to system components to each individual user, so you can trace who did what, when, and from where. This enables effective monitoring, detection of inappropriate activity, and a solid basis for investigations or forensic analysis. Storing logs off-site isn’t a stated mandate of this requirement, though secure protection and proper retention are important. Limiting audit trails to login events would miss critical activities like data access, changes, or other actions that impact security. Generating logs only for privileged users ignores the risk presented by regular users who could misuse access or be compromised. So the emphasis is on linking all access and actions to the exact user responsible.