c10.5 Timely detection and alerting of critical control failures
Detect, alert on, and address failures of critical security controls (e.g. logging, firewalls, anti-malware) in a timely manner to minimize the exposure window.
Requirement 10
Log and Monitor All Access to System Components and Cardholder Data
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
10.7 Failures of critical security control systems are detected, reported, and responded to promptly
- 10.7.1 Failures of critical security controls detected/alerted (SP only) Covered
- 10.7.2 Failures of critical security controls detected, alerted, addressed Covered
- 10.7.3 Failures of critical security controls responded to promptly Your responsibility
How to implement on AWS
Monitor the health of critical controls (CloudTrail active, GuardDuty enabled, Config recording on, WAF active) with AWS Config conformance packs and alarms. Automatically alert on failures via EventBridge/SNS and create incidents. Document response and remediation times.
Practical implementation
How this control is implemented in each reference architecture:
Detect and alert promptly when a critical security control fails or is disabled, and record the failure end-to-end.
- Monitor critical-control health (CloudTrail on, Config recording, GuardDuty enabled, WAF active) with AWS Config conformance packs and rules.Account-wide detection
AWS Config - Alert automatically on a failure via EventBridge to SNS and open an incident.Account automation
EventBridge - Record each failure with cause, start/end time, and remediation as PCI 10.7.3 evidence.Incident records
Amazon S3
How to validate: Disabling a control (e.g. stopping CloudTrail) raises an alert quickly, and the failure is documented with cause, duration, and remediation.
Avoid: Assuming controls stay on. They get disabled by mistake or attacker; monitor their health and alert on failure.
Watch critical-control health across every account centrally so a disabled control anywhere raises one tracked alert.
- Deploy the critical-control conformance packs org-wide and evaluate via the Config aggregator in the security tooling account.Security tooling account → PCI OU AWS Config
AWS Organizations - Raise a central alert when any CDE account disables a control (EventBridge to SNS).Security tooling account EventBridge
- Track each failure to remediation with consolidated records in the log-archive account.Log archive account Amazon S3
How to validate: A control disabled in any CDE account surfaces centrally and is tracked to remediation with a documented record.
Avoid: Per-account control-health checks with no rollup. A failure could go unnoticed; aggregate and alert centrally.
PCI validation
Testing procedures
- Examine documentation to verify processes are defined for prompt detection and reporting of failures of critical security controls, and observe alerting processes to confirm a failure generates an alert (10.7.2.a, 10.7.2.b).
- Examine records to verify failures are documented with cause, duration (start/end), and remediation details, and responded to per the requirement (10.7.3.a, 10.7.3.b).
Evidence in AWS
- Config conformance packs / rules that monitor the state of critical controls.
- EventBridge rules and SNS notifications on control failures.
- Incident records and remediation times for control failures.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 10.7 — Failures in critical security control systems are promptly identified and addressed.
AWS services
AWS Config Amazon EventBridge 
Amazon CloudWatch 
AWS Security Hub Learning resources
References
- PCI DSS v4.0.1 Requirement 10.7