FAQ #1081 Diff

The intent of the PCI DSS logging requirementrequirements is to provide a full record of who did what, where, when, and how, so that it can be used for investigation in the event of unexpected or unauthorized activities. InA additioncombination toof operating system logging, either database logginglogging, orand/or application logging (or a combination of both) shouldmay be implemented toas show accessappropriate to cardholderrecord data.the events defined in Requirement 10.2.110.2.

For specificallyexample, saysif the operating system and/or installed applications are able and configured to log ?allall individual access to cardholder data.?data Ifwithin your applications log all individuals? access to thea database, fullthen configuring database logging in addition to applicationthese loggingother logs may not be necessary. We suggest you contact a Qualified Security Assessor (QSA) for help with logging as they will be able to make recommendations based on an understanding of your actual environment. Our list of QSAs can be found at: https://www.pcisecuritystandards.org/pdfs/pci_qsa_list.pdf