Under 10.2.1, which events must be captured by automated audit trails?

Under 10.2.1, which events must be captured by automated audit trails?

• A. Only successful logins.
• B. All individual user accesses to cardholder data.
• C. All password changes.
• D. Only privileged actions.

Answer: (B)

Requiring automated audit trails to capture all individual user accesses to cardholder data means you can see exactly who accessed CHD, when they did it, and what they did with the data. This enables you to reconstruct events, support investigations, and ensure accountability for anyone touching CHD on any system component that stores, processes, or transmits it. Monitoring only successful logins misses the rest of the activity that occurs after authentication, such as viewing, modifying, or exporting data. Password changes concern authentication management, not data access, and recording only privileged actions overlooks normal users who may still access CHD. Capturing all individual user accesses provides the comprehensive view required to track and protect CHD.

Requiring automated audit trails to capture all individual user accesses to cardholder data means you can see exactly who accessed CHD, when they did it, and what they did with the data. This enables you to reconstruct events, support investigations, and ensure accountability for anyone touching CHD on any system component that stores, processes, or transmits it. Monitoring only successful logins misses the rest of the activity that occurs after authentication, such as viewing, modifying, or exporting data. Password changes concern authentication management, not data access, and recording only privileged actions overlooks normal users who may still access CHD. Capturing all individual user accesses provides the comprehensive view required to track and protect CHD.