Is it required to have logs for staging servers for PCI DSS requirements where the real cards are not used in this environments.

  • It all depends on your scope and what your QSA deems to be in scope. So, your question is not about logs at all, but about scope. Answer that part first, then the logs question is simple.
    – schroeder
    Oct 3, 2017 at 9:04

1 Answer 1


PCI DSS aside, why would you not want logs on staging.

The logging on stage should be exactly the same as used in live.

Stage by definition should be a clone of live. Setting up logging properly is no trivial task. Using stage to develop the log management processes should be like any other part of development. Get it right there and you are not wasting time and potential errors in live.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .