10.2.1.5 Audit logs capture all changes to identification and authentication credentials

Defined Approach Requirements

10.2.1.5 Audit logs capture all changes to identification and authentication credentials including, but not limited to:

• Creation of new accounts.
• Elevation of privileges.
• All changes, additions, or deletions to accounts with administrative access.

Customized Approach Objective

Records of all changes to identification and authentication credentials are captured.

Defined Approach Testing Procedures

10.2.1.5 Examine audit log configurations and log data to verify that changes to identification and authentication credentials are captured in accordance with all elements specified in this requirement.

Purpose

Logging changes to authentication credentials (including elevation of privileges, additions, and deletions of accounts with administrative access) provides residual evidence of activities.

Malicious users may attempt to manipulate authentication credentials to bypass them or impersonate a valid account.