▲
17
PCI DSS says 12 months of logs, does that mean 12 months of everything?
Reading 10.5.1 and trying to work out the scope before I budget for it.
Reading 10.5.1 and trying to work out the scope before I budget for it.
Our QSA also wanted the segmentation evidence to justify the scope boundary, which took longer than the logging work itself.
Worth adding that the three months immediately available is measured from now, not from the start of the year. People sometimes archive quarterly and end up with two months searchable in the first week of a quarter.
In scope systems only, not every log your estate produces.
10.5.1 is twelve months retained, three months immediately available for analysis. Immediately available is the part people miss. Three months has to be searchable without a restore, so tape does not count.
In scope means anything that stores, processes or transmits cardholder data, plus the systems protecting them. Your marketing site is almost certainly out. Your payment application is in.
Scope it carefully, the difference between everything and in scope is usually an order of magnitude in cost.