0

Recently we had an PCI Gap assessment, and the auditor asked as to show the application log, but we had very basic application log that only stores events and any exception. But auditor told us that transaction request & response log must be stored, Now we can do that but doing so will store card details (Which are encrypted) which we want to avoid as we don't want to store any card details. So what i want to know that it is required by the PCI that we must store the request post body, even if it contains encrypted card details?

Sorry if i have asked this question in wrong place but i didn't know any other place to ask such question, Thank You.

3

[is it] required by the PCI that we must store the request post body, even if it contains encrypted card details?

No, there is no PCI DSS requirement that you store incoming request POST body. In fact, while there's an entire section of the DSS (§10) dedicated to logging, it concerns itself with system and security logging, not transactional logging.

Transactional logging is mentioned largely in §3, mostly to prohibit storage of unencrypted sensitive data (track, CVV, PIN, ...) in transaction logs.

I think your auditor has a reasonable point that you need transactional logging, but that need not include raw request or response data. You should be logging things like time, source, internal transaction lookup, and response (as in, "success" or "failure", not response body).

These sorts of logs support normal business processes such as, "Hey, IP 1.2.3.4 submitted a fraudulent transaction at 12:34:56; tell me how many transactions they made that day and whether they were successful or not."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.