What must be reviewed at least daily under 10.6.1?

What must be reviewed at least daily under 10.6.1?

• A. All security events
• B. Only critical system components
• C. Logs of all servers not storing CHD/SAD
• D. Training logs

Answer: (A)

The main idea here is that security events must be reviewed daily across all in-scope systems. PCI DSS requires a daily look at the security-related events generated by systems and components that store, process, or transmit cardholder data (or could affect its security). The goal is to detect anomalies or potential incidents quickly so you can respond promptly. Reviewing every security event daily ensures you don’t miss indicators of compromise that might appear on any part of your environment, not just the most obvious or critical components. Security events include things like failed login attempts, unexpected privilege changes, unusual access patterns, configuration modifications, and alerts from security tools. Choosing anything narrower—such as only critical components or only servers that don’t store cardholder data—misses activity on other parts of the environment that could still impact security. Training logs aren’t about security events in the context of monitoring for incidents, so they aren’t the focus of this requirement.

The main idea here is that security events must be reviewed daily across all in-scope systems. PCI DSS requires a daily look at the security-related events generated by systems and components that store, process, or transmit cardholder data (or could affect its security). The goal is to detect anomalies or potential incidents quickly so you can respond promptly.

Reviewing every security event daily ensures you don’t miss indicators of compromise that might appear on any part of your environment, not just the most obvious or critical components. Security events include things like failed login attempts, unexpected privilege changes, unusual access patterns, configuration modifications, and alerts from security tools.

Choosing anything narrower—such as only critical components or only servers that don’t store cardholder data—misses activity on other parts of the environment that could still impact security. Training logs aren’t about security events in the context of monitoring for incidents, so they aren’t the focus of this requirement.