Log Management
PCIComplianceHubLast updated
The lifecycle around log data: collecting it from across the estate, centralising it, protecting it from alteration or deletion, retaining it for a defined period, reviewing it and disposing of it. PCI DSS requires at least 12 months of retention with the most recent three months immediately available, daily review of security-critical logs, and, under v4.x, automated mechanisms to perform that review. Centralising logs onto a separate hardened system matters because an attacker who controls a host can otherwise edit the evidence of the intrusion.
Applies to. PCI DSS v4.0.1 does not use the phrase log management; the lifecycle it describes is spread across Requirement 10. Audit logs must be enabled on all system components, protected so existing log data cannot be altered without an alert, reviewed at least daily with automated mechanisms doing the review, and retained for at least 12 months with the most recent three months immediately available. Failure of the logging or log review mechanisms is itself a critical security control failure that must be detected, alerted on and addressed.
Limits. The standard does not name a log management product or architecture; it tests that the records exist, cannot be silently changed, are reviewed on time and are kept for the retention period, however that is achieved.
Related. Audit Log / Audit Trail, Logging, Automated Log Review, Security Information and Event Management (SIEM), File Integrity Monitoring
Sources. PCI DSS v4.0.1 (June 2024)