Forum
17

PCI DSS says 12 months of logs, does that mean 12 months of everything?

asked by gerald (Gerald) 19 days ago

Reading 10.5.1 and trying to work out the scope before I budget for it.

2 answers

Sign in to answer.
tony (Tony) 18 points 18 days ago

In scope systems only, not every log your estate produces.

10.5.1 is twelve months retained, three months immediately available for analysis. Immediately available is the part people miss. Three months has to be searchable without a restore, so tape does not count.

In scope means anything that stores, processes or transmits cardholder data, plus the systems protecting them. Your marketing site is almost certainly out. Your payment application is in.

Scope it carefully, the difference between everything and in scope is usually an order of magnitude in cost.

gerald (Gerald) 6 points 17 days ago

Our QSA also wanted the segmentation evidence to justify the scope boundary, which took longer than the logging work itself.

Guidelines Newest Search Back to Trunc