A3.3.1 Failures of critical security control systems are detected, alerted, and addressed promptly

Defined Approach Requirements

A3.3.1 Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure of:

• Network security controls
• IDS/IPS
• FIM
• Anti-malware solutions
• Physical access controls
• Logical access controls
• Audit logging mechanisms
• Segmentation controls (if used)
• Automated audit log review mechanisms. This bullet is a best practice until its effective date; refer to Applicability Notes below for details.
• Automated code review tools (if used). This bullet is a best practice until its effective date; refer to Applicability Notes below for details.

PCI DSS Reference: Requirements 1-12

Customized Approach Objective

This requirement is not eligible for the customized approach.

Applicability Notes

The bullets above (for automated log review mechanisms and automated code review tools (if used)) are best practices until 31 March 2025, after which they will be required as part of Requirement A3.3.1 and must be fully considered during a PCI DSS assessment.

Defined Approach Testing Procedures

A3.3.1.a Examine documented policies and procedures to verify that processes are defined to promptly detect, alert, and address critical security control failures in accordance with all elements specified in this requirement.

A3.3.1.b Examine detection and alerting processes, and interview personnel to verify that processes are implemented for all critical security controls specified in this requirement and that each failure of a critical security control results in the generation of an alert.

Purpose

Without formal processes for the prompt (as soon as possible) detection, alerting, and addressing of critical security control failures, failures may go undetected or remain unresolved for extended periods. In addition, without formalized time-bound processes, attackers will have ample time to compromise systems and steal account data from the CDE.

Good Practice

The specific types of failures may vary, depending on the function of the device system component and technology in use. Typical failures include a system ceasing to perform its security function or not functioning in its intended manner, such as a firewall erasing all its rules or going offline.

Sub-Requirements

• A3.3.1.1 Failures of any critical security control systems are responded to promptly