.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Compliance supportPCI DSS v4.0
Evidence for PCI DSS access and logging requirements
PCI DSS v4.0 Requirements 7, 8 and 10 are about restricting access to the cardholder data environment, identifying and authenticating users, and logging and monitoring that access. SWOT PAM and SWOT DAM produce evidence for each.
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
What the access and logging requirements ask for
- 01
Requirement 7: need to know
Access to cardholder data and system components is limited to what each role needs, and reviewed.
- 02
Requirement 8: who is who
Every user is uniquely identified and authenticated, with MFA for access into the cardholder data environment.
- 03
Requirement 10: logged and kept
Access is logged, the logs are protected, and they are retained and reviewed.
See it work
Requirement by requirement
Choose a PCI DSS v4.0 requirement to see the SWOT evidence that supports it.
7.2.1
Access control model
The clause asks
An access control model is defined and covers access to system components and data.
SWOT evidence
Access policies define who can reach which targets, for how long and with which approvals; directory groups map to roles.
SWOT PAM7.2.2
Least privilege
The clause asks
Access is assigned based on job function and least privilege.
SWOT evidence
Just-in-time grants scoped to one target and a time window; temporary database accounts removed on disconnect.
SWOT PAM7.2.4
Access reviews
The clause asks
User accounts and access privileges are reviewed at least once every six months.
SWOT evidence
Every request, approval and grant is on the audit trail, with active grants and expiries visible for review.
SWOT PAM8.2.1
Unique IDs
The clause asks
All users are assigned a unique ID before access is allowed.
SWOT evidence
Each person signs in as themselves through SSO; the proxy injects shared credentials so sessions stay tied to a named user.
SWOT PAM8.2.2
Shared accounts
The clause asks
Group, shared or generic accounts are used only when necessary and are managed.
SWOT evidence
Shared credentials sit in the Central Vault, checked out per person and rotated after use.
SWOT PAM8.4.2
MFA into the CDE
The clause asks
MFA is implemented for all access into the cardholder data environment.
SWOT evidence
TOTP multi-factor authentication for every session, including native SSH and database clients.
SWOT PAM10.2.1
Audit logs
The clause asks
Audit logs are enabled and active for all system components and cardholder data.
SWOT evidence
Session recordings and command logs from the proxy; native audit collection from cardholder databases.
SWOT DAM10.2.1.5
Privilege changes
The clause asks
Changes to identification and authentication credentials, including elevation of privileges, are logged.
SWOT evidence
Alerts on GRANT DBA, superuser and policy changes; PAM logs every grant and policy edit.
SWOT DAM10.3
Log protection
The clause asks
Audit logs are protected from destruction and unauthorised modification.
SWOT evidence
A SHA-256 hash chain over every event, insert-only audit tables, signed exports and Object Lock storage for recordings.
SWOT PAM10.5.1
Log retention
The clause asks
Audit log history is retained for at least 12 months, with three months immediately available.
SWOT evidence
Recordings and audit data stay in your own storage, retained for as long as your policy sets.
SWOT PAM1 of 10 clauses viewed
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
The products
What each product does here
Does SWOT make us PCI DSS compliant?
No product does on its own. SWOT PAM and SWOT DAM produce evidence relevant to PCI DSS Requirements 7, 8 and 10; whether your environment meets a requirement depends on configuration, scope and your QSA’s assessment.
Which PCI DSS requirements does privileged access management support?
Mainly Requirement 7 (restrict access by need to know), Requirement 8 (identify and authenticate users, including MFA into the CDE) and Requirement 10 (log, protect and retain audit records).
Can auditors check the logs have not been changed?
Yes. Events are sealed in a SHA-256 hash chain and exports carry signatures and receipts, so a change shows.
See it on your own systems
A walk-through of SWOT PAM and SWOT DAM with the team that builds them.