Which PCI DSS requirement is associated with logging and audit trails that are unique to each entity's cardholder data environment?

Which PCI DSS requirement is associated with logging and audit trails that are unique to each entity's cardholder data environment?

• A. Requirement 6
• B. Requirement 10
• C. Requirement 3
• D. Requirement 12

Answer: (B)

Logging and audit trails in the cardholder data environment are about accountability and the ability to reconstruct events when something happens. PCI DSS requires that systems generate detailed logs of access and activity, protect those logs from tampering, and keep them for an extended period so you can trace actions back to who did what and when. Having time-synchronized timestamps ensures you can accurately sequence events across different systems, which is essential for investigating incidents. The idea is that each entity’s own CDE has its own set of logs and audit trails so actions can be attributed precisely to the correct environment, user, and system. This focus on generating, protecting, and reviewing logs is why this option fits best. Other requirements tend to address broader secure system development and change management, protection of stored data, or operational security programs, rather than the specific practice of logging, monitoring, and audit trails.

Logging and audit trails in the cardholder data environment are about accountability and the ability to reconstruct events when something happens. PCI DSS requires that systems generate detailed logs of access and activity, protect those logs from tampering, and keep them for an extended period so you can trace actions back to who did what and when. Having time-synchronized timestamps ensures you can accurately sequence events across different systems, which is essential for investigating incidents. The idea is that each entity’s own CDE has its own set of logs and audit trails so actions can be attributed precisely to the correct environment, user, and system.

This focus on generating, protecting, and reviewing logs is why this option fits best. Other requirements tend to address broader secure system development and change management, protection of stored data, or operational security programs, rather than the specific practice of logging, monitoring, and audit trails.