PCI DSS 11.5.2 file integrity monitoring
Your assessor picks a date. You show what changed.
Requirement 11.5.2 asks for an alert when critical files change, and a comparison at least once a week. Alertica checks the files on your servers every day from outside, alerts the people you choose, and records who reviewed each alert and why. Our team sets it up with you on Pro, and there's a free plan that never expires.
- Agentless, nothing to install
- Daily comparison, weekly is the minimum
Who it's for
Any business with servers in its cardholder data environment that it can reach over SFTP or FTP.
Built for
- SaaS companies, payment and billing providers, and other service providers that handle card data
- Online stores and payment pages you host yourself, on any platform
- MSPs and agencies that answer 11.5.2 for their clients
What Alertica covers in PCI DSS
11.5.2 in full, and evidence for four more. Where a requirement needs more than a file monitor, the last column says what.
| Requirement | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| 11.5.2 Change detection | Alert staff when critical files are changed, added or deleted, and compare them at least weekly. | Compares the files you choose on every scan, daily on Pro. Alerts by email or SMS when one is added, deleted, or changed in its contents, date or size. | Decide which files are critical, and answer each alert. |
| 10.3.4 Logs can't be altered | Use change detection on audit logs, so existing log data can't change without an alert. | Watches the folder your logs rotate into. A closed log that changes or disappears raises an alert. | Point it at closed logs. A live log grows with every write. |
| 10.4.1 Daily review | Review security events and critical system logs at least once a day. | Scans daily on Pro, and every file alert is acknowledged with who, when and a note, so your daily review of file changes is on record. | Review your other security logs each day, such as firewall, logins and apps. |
| 10.5.1 12 months of history | Keep audit log history for 12 months, with the latest 3 months at hand. | Keeps 12 months of alert and scan history on Pro, all of it in the app and in one download. | Keep your server and application logs for 12 months. |
| 12.10.5 Incident response | The incident response plan covers alerts from change detection on critical files. | Every alert is acknowledged with who, when and a required note, so each response is on record. | Write the plan, and name who answers the alerts. |
| 11.6.1 Payment page scripts | Detect unauthorized changes to the scripts and security headers of the payment page, as the customer's browser receives them. | Not covered Alertica sees files on your server, not what loads in the browser. | Use a payment page script monitor. |
What your assessor sees
Assessors test a period, not a day. They pick dates and ask what happened on each one. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note saying why. That note is the response record 12.10.5 asks for.
-
Twelve months of history
Pro keeps a year of alerts and scans, the same 12 months 10.5.1 asks for logs. Any date the assessor picks is covered.
-
Proof it ran every week
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. 11.5.2 asks for a weekly comparison; this shows each one happened.
-
Audit-ready evidence in one download
Pick the assessment period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent, no plugin and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An agent or plugin on the server can be switched off by whoever got in. Alertica runs on our servers, out of their reach.
-
Only fingerprints leave
Alertica works out a fingerprint of each file on your server. File contents and card data never leave it.
-
Set up with you
On Pro and Enterprise our team sets the rules to match 11.5.2 with you, server by server.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Turn on the PCI checks
Pick the folders that hold your code, config and logs. We set this up with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept for your assessor.
Questions about PCI DSS 11.5.2
What Alertica covers, what it doesn't, and what your assessor will see.
-
Does Alertica make us PCI DSS compliant?
Alertica covers the file monitoring in requirement 11.5.2 and gives you evidence for 10.3.4, 10.4.1, 10.5.1 and 12.10.5. Your QSA, or your self- assessment questionnaire, looks at the rest of PCI DSS.
-
Is a daily scan enough for 11.5.2?
Yes. The requirement asks for a comparison at least once a week. Pro compares every day and Free once a week. Hourly scans come with Enterprise.
-
Which files count as critical?
PCI DSS leaves the list to you. We usually start with the application's code, its config files and the log archive, and on Pro we set it up with you.
-
Does Alertica cover requirement 11.6.1?
No. 11.6.1 is about scripts that load in the customer's browser on the payment page. Alertica watches the files on your server. You need both.
-
Do you copy our files or card data?
No. Alertica works out a fingerprint of each file on your server and reads back only that, with the file's name, size and date. File contents never leave the server.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
Ready-made checks for online stores
Set up 11.5.2 with our team
Tell us about the systems in your PCI DSS scope, or your clients'. We'll set up the rules to match 11.5.2 with you and go through the first scan together.