Requirement 10 — Log and Monitor All Access

The Windows event codes that give an auditor direct evidence for each PCI DSS 10.2.1 sub-requirement below.

Scope: Covers the seven event-logging sub-requirements of 10.2.1 — the part of Requirement 10 that's actually about log content. All 7 map to real event evidence, two with an explicit SACL-configuration caveat. The rest of Requirement 10 (documented process, log protection architecture, review cadence, 12-month retention, time sync, control-failure monitoring) is named honestly in the gap section below rather than force-mapped.

Version: PCI DSS v4.0.1, mandatory as of March 31, 2025 — the current enforced version, superseding v3.2.1 and the interim v4.0.