A chronological record of activity on a system: who did what, to which resource, from where and when. PCI DSS Requirement 10 sets out what must be captured for system components in scope, including all access to account data, all actions taken by users with administrative privilege, access to the logs themselves, invalid access attempts, changes to accounts and credentials, and the starting, stopping or pausing of logging. Logs must be protected against alteration, retained for at least 12 months, and the most recent three months kept immediately available for analysis. Audit logs are often the only evidence available after a compromise, which is why their integrity is treated as a control in its own right.
Applies to. Applies to every in-scope system component. 10.2.1 requires audit logs to be enabled and active for all system components and cardholder data, 10.2.2 fixes what each entry records (user, event type, date and time, success or failure, origin, and the data, component or resource affected), 10.3.1 limits read access to those with a job-related need, 10.3.3 has the logs promptly backed up to a central server or media that is hard to alter, and 10.3.4 puts file integrity monitoring or change detection on them so existing entries cannot change without an alert. 10.5.1 sets retention at 12 months with the most recent three immediately available. 10.4.1 lists the logs that must be reviewed at least once daily, and 10.7.2 names the audit logging mechanism itself as a critical security control whose failure must be detected, alerted and addressed promptly.
Example. A retailer's payment switch, database servers, domain controllers and firewalls all send their logs to a central log server. When an administrator account changes a firewall rule at two in the morning, the entry records the account, the source address, the time and the rule that changed, and the next morning's review flags it for someone to confirm the change was approved.
Limits. An audit log is the record, not the review: keeping logs satisfies neither 10.4.1, which requires the listed logs to be reviewed daily, nor 10.7.2, which requires a failure of the logging mechanism to raise an alert. A log is not a safe place for account data: 3.5.1.b examines audit logs, including payment application logs, for readable PAN, so a debug log that captures full card numbers has become stored account data. Retention is judged on the copy that can still be produced, so if a device overwrites its own log after a few weeks the 12-month and three-month rules in 10.5.1 have to be met by a copy held elsewhere. Camera footage and door-access records kept under 9.2.1.1 are a separate record with their own three-month floor, not audit logs under Requirement 10.