Logging

Applies to. Requirement 10 is the home of logging: audit logs must be enabled and active on every in-scope system component and must capture the events the standard lists. Elsewhere the standard treats logging as something other controls depend on. Bespoke and custom software must be developed in line with PCI DSS, with secure logging given as the example (6.2.1), and failure of audit logging mechanisms counts as a critical security control failure that must be detected, alerted on and addressed promptly (10.7.2, and 10.7.1 for service providers).

Limits. Logging is the act of recording. What must be captured, how records are protected, how often they are reviewed and how long they are kept are separate requirements; see Audit Log / Audit Trail and Log Management.