My question is: for PCI DSS compliance is it possible to have a
business justification for this incident, as the logs are lost, or
what to do in this case.
You can try justifying why you lost the logs, but in all honesty if you can't maintain a suitable secure copy of them then its debatable whether you are (or even were) truely PCI-DSS compliant. (I don't know what levels you are intending to be compliant against)
That said: PCI DSS Requirement 10.5 and its
sub-requirements describe the methods that must be employed to protect logs:
- 10.5 Secure audit trails so they cannot be altered
- 10.5.1 Limit viewing of audit trails to those with a job-related need
- 10.5.2 Protect audit trails from unauthorized modifications
- 10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter
- 10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device
- 10.5.5 Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).
I have highlighted the ones that I believe you accidentally failed to comply with. Therefore I would make sure you update your policies and ensure that you have suitable controls in place to ensure it doesn't happen again. As long as you can demonstrate your corrective measures I think you will be fine.