0

We have a task open right now to implement UAC and matching event log tracking for our devs installing software on their machines. I've been asked whether storing/parsing these logs centrally is a requirement for PCI compliance.

I am but an egg. I've flipped through the PCI-DSS 3.1 document, but found nothing definitive. What should I do?

1
  • Are you development machines in the Prod PCI environment? That's kinda scary. Commented Aug 21, 2015 at 18:23

2 Answers 2

0

I agree with Shane Andrie. Dev machines considered in PCI scope is quite scary. I'd rather look in to moving them out of scope irrespectively of logging requirements.

To answer your question: Yes, storing logs centrally is a PCI requirement. Please refer to requirement 10.5 (excl 10.5.5).

10.5.1 Limit viewing of audit trails to those with a job-related need.
10.5.2 Protect audit trail files from unauthorized modifications.
10.5.3 Promptly back up audit trail files to a centralized log server or media that is difficult to alter.
10.5.4 Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.

1
  • "centrally or media that is difficult to alter" Centrally isn't a requirement but an option.
    – schroeder
    Commented Aug 22, 2015 at 0:16
-1

Short answer; Yes logs must be retained for a year, and the last 3 months logs must be easy to access. Lots more detail in the link below.

Stack Exchange: what logs to retain for pci-dss

3
  • This doesn't address the question about the "centrality" of the log collection.
    – schroeder
    Commented Aug 21, 2015 at 18:36
  • The logs for the last 3 months must be easily accessible. The logs for the last year must be at least archived. That is required for compliance. If you can be compliant without central storage then crack on. Commented Aug 21, 2015 at 18:38
  • Your answer of "Yes", then makes no sense. Shouldn't it be "No"?
    – schroeder
    Commented Aug 21, 2015 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .