{"id":603499,"date":"2019-09-26T06:15:00","date_gmt":"2019-09-26T06:15:00","guid":{"rendered":"https:\/\/www.capgemini.com\/us-en\/?p=603499"},"modified":"2026-02-27T07:35:09","modified_gmt":"2026-02-27T12:35:09","slug":"pci-compliance-log-management","status":"archive","type":"post","link":"https:\/\/www.capgemini.com\/us-en\/insights\/expert-perspectives\/pci-compliance-log-management\/","title":{"rendered":"PCI compliance \u2013 Log management"},"content":{"rendered":"\n

PCI compliance \u2013 Log management<\/h1><\/div><\/div><\/div><\/div>
\"\"<\/div>
Capgemini<\/h5>
2019-09-26<\/h5><\/div><\/div>
<\/div><\/div><\/div><\/div><\/header>\n\n\n\n
\n

PCI compliance<\/h1>\n\n\n\n

We talk a lot about PCI in the digital-commerce space, whether that\u2019s TLS versions, vulnerability scans, iframes, and verifying code security. What we don\u2019t talk enough about, though, is logging, log retention, and log monitoring.<\/p>\n\n\n\n

When was the last time that you know someone looked through your commerce site\u2019s logs? Do you know how long you are keeping your logs? Are you sure you\u2019re logging enough information?<\/p>\n\n\n\n

These questions, and other questions like them, are essential for developing a solid \u201csituational awareness\u201d of your commerce site. The PCI DSS Requirement 10 states that you need to be aware of the technical performance of your site. You need to be aware of who is using the administrative functions of your site, when they are using them, and what they are doing with their administrative access. You need to be able to see who has access to the audit trails and who can turn the audit trails off and on. You even need to report on invalid access attempts to your administration pages.<\/p>\n\n\n\n

Beyond this, your application logs can tell you that:<\/p>\n\n\n\n