08 Logging & Monitoring

Logging and monitoring provide visibility into what is happening inside the Cardholder Data Environment (CDE).

Preventive controls such as:

Firewalls

MFA

Least Privilege

Secure Configuration

Vulnerability Management

reduce the likelihood of compromise.

But organizations also need to detect:

Unauthorized Access

Privilege Changes

Suspicious Authentication

Configuration Changes

Security-Control Failures

Potential Cardholder Data Access

A strong PCI logging and monitoring model looks like:

CDE Activity
      ↓
Audit Logs
      ↓
Central Collection
      ↓
Time Synchronization
      ↓
Security Analytics
      ↓
Alerting
      ↓
Review
      ↓
Investigation
      ↓
Incident Response
      ↓
Evidence Retention

The central question is:

If something suspicious or unauthorized occurs in the CDE, can the organization detect it, determine what happened, identify who performed the activity, investigate it, and retain sufficient evidence?

Learning Objectives

By the end of this lesson, you will be able to:

Explain why logging is important in PCI DSS.
Identify important CDE log sources.
Understand audit-trail requirements.
Identify critical security events.
Understand centralized log collection.
Understand SIEM integration.
Understand daily and periodic log reviews.
Understand automated monitoring.
Understand alert triage and investigation.
Understand privileged-activity monitoring.
Understand authentication monitoring.
Understand time synchronization.
Understand PCI log-retention principles.
Protect logs from unauthorized modification.
Identify logging coverage gaps.
Build a CDE logging inventory.
Build a critical-event catalog.
Build a monitoring matrix.
Test logging and monitoring controls.
Collect PCI logging evidence.
Maintain continuous monitoring assurance.

1. Why Logging Matters

Consider:

Payment Database
      ↓
Unauthorized Query
      ↓
PAN Export

Without logging:

Who accessed it?

When?

From where?

Which account?

What data?

Unknown

With effective logging:

Identity
      ↓
Timestamp
      ↓
Source
      ↓
Action
      ↓
Target
      ↓
Result

can support investigation.

2. Logging vs Monitoring

These concepts are related but different.

Logging records events.

Event
      ↓
Audit Record

Monitoring analyzes events and identifies activity requiring attention.

Logs
      ↓
Analysis
      ↓
Alert
      ↓
Investigation

3. Logging Without Monitoring

Weak:

Millions of Logs
      ↓
Nobody Reviews Them

Logging exists, but security value is limited.

4. Monitoring Without Good Logs

Likewise:

SIEM
      ↓
Missing CDE Logs

means the monitoring platform cannot see important activity.

Strong PCI monitoring therefore requires both:

Complete Logging
+
Effective Monitoring

5. Start With the CDE Asset Inventory

Use your:

PCI In-Scope Asset Register

to determine what must generate security-relevant logs.

Potential sources include:

Payment Applications

Databases

Servers

Firewalls

Cloud Platforms

Identity Systems

Kubernetes

Security Tools

Administrative Systems

6. Build CDE Logging Coverage Register

Create:

01 CDE Logging Coverage Register

Use:

Asset	Log Source	Logging Enabled	Centralized	Owner

7. Coverage Target

For applicable in-scope systems:

Target:
100%

A system without required logging can create:

Security Visibility Gap

8. Log Source Inventory

Create:

02 PCI Log Source Inventory

Use:

Log Source	System	Events	Destination	Retention

9. Operating System Logs

OS logs may include:

Successful Login

Failed Login

Privilege Escalation

Account Creation

Service Changes

System Errors

10. Application Logs

Payment applications may log:

Authentication

Administrative Changes

Transactions

Application Errors

Security Events

API Activity

Application logs must be designed carefully to avoid unintentionally recording sensitive payment data.

11. Database Logs

Database logging can provide visibility into:

Authentication

Administrative Queries

Privilege Changes

Schema Changes

Data Access

12. Firewall Logs

Firewalls may record:

Allowed Connections

Blocked Connections

Administrative Changes

VPN Sessions

13. Identity Logs

Identity platforms may record:

Authentication

MFA

Failed Authentication

Privilege Assignment

User Creation

User Disablement

14. Cloud Audit Logs

Cloud environments typically provide management-plane audit logs.

Examples may record:

IAM Changes

Network Changes

Storage Changes

Logging Changes

Resource Creation

Resource Deletion

15. Kubernetes Audit Logs

For payment workloads in Kubernetes, consider:

API Server Requests

RBAC Changes

Secret Access

Deployment Changes

Administrative Actions

16. CI/CD Logs

If deployment pipelines can modify CDE applications, relevant events may include:

Pipeline Execution

Production Deployment

Approval

Credential Usage

Pipeline Configuration Change

17. Security Tool Logs

Examples:

EDR Alerts

Vulnerability Scanner Events

IDS / IPS Events

WAF Events

DLP Alerts

18. Audit Trail Objective

A useful audit trail should help answer:

Who?

What?

When?

Where?

Result?

19. User Identification

Logs should associate activity with:

Individual Identity

where applicable.

Weak:

admin

shared by multiple people.

Stronger:

alice-admin

with traceable individual accountability.

20. Timestamp

Logs should include:

Date

Time

Timezone / Standard

so events can be reconstructed accurately.

21. Event Type

Examples:

Login

Logout

Privilege Change

Configuration Change

Data Access

Security Alert

22. Event Result

Capture:

Success

Failure

where applicable.

Failed events can be extremely important.

23. Source Information

Useful fields may include:

Source IP

Hostname

Device

Application

Session

24. Target Information

Example:

User:
alice-admin

Action:
DELETE

Target:
payment-record

depending on application logging requirements.

25. Critical Event Catalog

Create:

03 PCI Critical Event Catalog

Use:

Event	Source	Severity	Alert Required	Owner

26. Critical Authentication Events

Examples:

Repeated Failed Login

Privileged Login

Break-Glass Login

Disabled Account Login Attempt

MFA Failure

27. Privileged Activity

Monitor:

New Administrator

Privilege Escalation

Role Assignment

Root Usage

Database Admin Activity

28. Account Management Events

Examples:

Account Created

Account Deleted

Account Enabled

Account Disabled

Password Reset

29. Security Control Changes

Monitor attempts to:

Disable Logging

Disable EDR

Change Firewall Rules

Disable MFA

Modify SIEM Configuration

30. Logging Control Failure

Example:

CDE Server
      ↓
Stops Sending Logs

This itself should be treated as a monitoring event.

31. Data Access Events

Where applicable, monitor significant access to:

Cardholder Data

Payment Databases

Sensitive Files

Cryptographic Systems

32. Application Security Events

Examples:

SQL Injection Attempt

Authentication Bypass Attempt

WAF Block

Unauthorized API Request

33. Network Events

Examples:

CDE Port Scan

Blocked Corporate-to-CDE Connection

Unauthorized Outbound Connection

Unexpected Remote Access

34. Malware Events

Examples:

Malware Detection

EDR Isolation

Suspicious Process

Credential Dumping

35. Centralized Logging

A strong architecture typically sends security-relevant logs to a controlled central platform.

Example:

Payment Application ───┐
Database ───────────────┤
Firewall ───────────────┤
Cloud Platform ─────────┼──→ SIEM / Log Platform
IAM ────────────────────┤
Kubernetes ─────────────┤
EDR ────────────────────┘

36. Why Centralize?

Central collection helps with:

Correlation

Retention

Search

Alerting

Investigation

Protection

37. Local Logs Only

Weak:

Attacker Compromises Server
      ↓
Deletes Local Logs

If logs are centrally forwarded:

Server
      ↓
Central Log Platform

historical evidence may remain available.

38. SIEM

A Security Information and Event Management platform can support:

Centralized Logging

Correlation

Detection Rules

Alerting

Investigation

Dashboards

39. Build SIEM Monitoring Matrix

Create:

04 SIEM Monitoring Matrix

Use:

Use Case	Source	Detection	Priority	Response

40. Detection Use Case — Failed Logins

Example:

10 Failed Administrative Logins
Within 5 Minutes

Action:

Security Alert

41. Detection Use Case — New CDE Administrator

New Privileged Role
      ↓
Alert
      ↓
Validate Approval

42. Detection Use Case — Logging Disabled

Audit Logging Disabled
      ↓
High-Priority Alert

43. Detection Use Case — Firewall Change

CDE Firewall Rule
Changed
      ↓
Validate Change Record

44. Detection Use Case — Public Exposure

Cloud rule changes to:

0.0.0.0/0
      →
Administrative Port

should receive immediate attention.

45. Detection Use Case — Database Export

Example:

Unusual Bulk Query
      ↓
Large Data Export

may trigger investigation.

46. Log Review

PCI DSS requires organizations to review relevant security logs and events according to applicable requirements.

The goal is:

Important Security Events
      ↓
Actually Reviewed

not simply retained.

47. Daily Log Review

High-risk systems and security events may require daily review under applicable PCI DSS requirements.

A practical daily review may include:

Critical Security Alerts

Authentication Events

Privileged Activity

Security-Control Failures

Suspicious CDE Activity

48. Automated Review

Modern environments can automate large portions of review.

Example:

Logs
      ↓
SIEM Detection Rules
      ↓
Alert Queue
      ↓
Analyst Review

Automation does not eliminate the need for:

Investigation

Ownership

Escalation

49. Build Daily Log Review Register

Create:

05 Daily Log Review Register

Use:

Date	Environment	Reviewer	Alerts	Exceptions	Status

50. Daily Review Evidence

Evidence should show:

Date

Reviewer

Systems / Alerts Reviewed

Findings

Actions

51. Weak Review Evidence

Weak:

"Logs reviewed."

Strong:

Review Date:
15 Aug

Reviewer:
Security Analyst

Critical Alerts:
8

Investigated:
8

Escalated:
1

52. Review Frequency

Not every log source necessarily receives identical manual review.

Use applicable PCI requirements plus:

Risk

System Criticality

Monitoring Architecture

to establish the review process.

53. Automated Mechanisms

Automated mechanisms can improve:

Coverage

Speed

Consistency

Alert Prioritization

54. Alert Triage

A typical workflow:

Alert
      ↓
Validate
      ↓
Determine Severity
      ↓
Investigate
      ↓
Escalate / Close

55. Alert Severity

Use standardized categories such as:

Critical

High

Medium

Low

56. Critical Alert Example

Payment Database Administrator
Logs In
from Unknown Country
      ↓
MFA Challenge
      ↓
Bulk Data Query

Potential severity:

Critical

57. False Positive

Some alerts are legitimate.

Example:

New Admin Account

was created through an approved access request.

Status:

Expected Activity

Document the validation.

58. Security Investigation Record

Create:

06 PCI Security Alert Investigation Register

Use:

Alert	Source	Severity	Analyst	Result	Incident

59. Incident Escalation

When monitoring identifies potential compromise:

Alert
      ↓
Investigation
      ↓
Security Incident
      ↓
Incident Response Process

60. Logging Supports Incident Response

Without historical logs, teams may struggle to answer:

Initial Access?

Affected Accounts?

Systems Touched?

Data Accessed?

Duration?

61. Time Synchronization

Logs from different systems must use consistent time.

Example:

Firewall:
10:03

Database:
10:41

Application:
09:55

If clocks are inaccurate, event reconstruction becomes difficult.

62. Central Time Source

A better model:

Approved Time Source
      ↓
CDE Servers

Network Devices

Databases

Security Systems

63. Build Time Synchronization Register

Create:

07 Time Synchronization Register

Use:

System	Time Source	Synchronized	Drift	Owner

64. Time Source Security

Protect time configuration from unauthorized modification.

Because an attacker could:

Alter Time
      ↓
Confuse Audit Trail

65. Time Drift

Monitor significant differences.

Example:

Allowed:
Small Operational Drift

versus:

Detected:
42-Minute Difference

which requires investigation.

66. Log Protection

Logs are security evidence.

They should be protected against:

Unauthorized Modification

Deletion

Tampering

Uncontrolled Access

67. Log Access

Use:

Least Privilege

for log platforms.

Typical users may include:

SOC Analysts

Security Administrators

Auditors

with different roles.

68. Separate Log Administration

Avoid allowing ordinary CDE administrators to freely:

Modify

Delete

central audit evidence where segregation can be implemented.

69. Immutable / Protected Storage

Organizations may use:

Write-Once Controls

Immutable Storage

Restricted Deletion

Retention Lock

where appropriate.

70. Log Integrity

Integrity mechanisms can help detect:

Alteration

Deletion

Collection Failure

71. Central Log Collector Availability

If the log platform fails:

CDE
      ↓
No Central Logs

the organization needs to detect that failure.

72. Log Ingestion Monitoring

Monitor:

Last Event Received

Event Volume

Agent Health

Pipeline Errors

73. Logging Coverage Alert

Example:

PAY-DB-01
      ↓
No Logs for 30 Minutes

Alert:

Logging Coverage Failure

74. Build Log Health Register

Create:

08 Log Collection Health Register

Use:

Source	Expected	Last Received	Status	Owner

75. Log Retention

PCI DSS v4.x includes specific retention expectations for audit logs.

A commonly required model is:

At Least 12 Months
Total Retention

with:

At Least 3 Months
Immediately Available

for analysis, subject to the applicable requirement and assessment scope.

76. Build Log Retention Register

Create:

09 Log Retention Register

Use:

Log Source	Retention	Immediate Availability	Storage	Owner

77. Retention Example

Firewall Logs
      ↓
3 Months Hot Search
      ↓
9 Additional Months Archive

Total:

12 Months

78. Retention Failure

Required:

12 Months

Actual:

30 Days

Result:

PCI Logging Gap

79. Retention vs Availability

A log may technically exist in an archive but take:

3 Weeks

to restore.

That may not meet immediate-availability expectations for the portion of logs required to be readily accessible.

80. Log Storage Capacity

Ensure retention design accounts for:

Daily Event Volume

Growth

New Systems

Security Events

81. Log Data Minimization

Logs should provide necessary audit detail without unnecessarily recording:

Full PAN

Authentication Secrets

Sensitive Authentication Data

82. PAN in Logs

Example:

Transaction:
PAN=4111111111111111

This can expand storage risk and PCI scope.

Prefer appropriate:

Masking

Tokenization

Redaction

depending on the logging use case.

83. Never Log Authentication Secrets

Avoid logging:

Passwords

CVV

Private Keys

API Secrets

84. Application Logging Standard

Developers should know:

What to Log

What Not to Log

How to Protect Logs

85. Build PCI Logging Standard

Create:

10 PCI Logging & Monitoring Standard

Include:

Scope

Required Events

Log Fields

Collection

Monitoring

Review Frequency

Retention

Protection

Escalation

86. Cloud Logging

Cloud CDEs may require visibility into:

Management Events

Authentication

Network Flow

Storage Access

Configuration Changes

87. Cloud Audit Log Example

Administrator
      ↓
Changes Security Group
      ↓
Cloud Audit Event
      ↓
SIEM
      ↓
Alert

88. Cloud Logging Gap

Example:

Production Payment Account

has:

Management Audit Logging Disabled

This is a significant visibility gap.

89. Multi-Account Cloud Logging

A scalable model:

Payment Account ─────┐
Security Account ────┤
Network Account ─────┼──→ Central Security Logging Account
Management Account ──┘

90. Log Separation

A dedicated logging/security account may reduce the ability of a compromised workload administrator to destroy audit evidence.

91. Kubernetes Logging

Consider:

API Audit Logs

Container Logs

Ingress Logs

Authentication

RBAC Changes

92. Kubernetes Example

User
      ↓
Creates ClusterRoleBinding
      ↓
cluster-admin

This should generate audit evidence and potentially an alert.

93. Container Logs

Application container logs may be ephemeral.

Without centralized forwarding:

Pod Deleted
      ↓
Logs Lost

94. CI/CD Monitoring

Monitor production pipeline activity.

Examples:

Deployment Started

Approval Bypassed

Pipeline Modified

Production Secret Accessed

95. Database Activity Monitoring

High-risk databases may warrant monitoring for:

Large PAN Queries

Privilege Changes

Schema Changes

Unusual Access Times

96. File Integrity / Change Detection

Monitoring may also include detection of unauthorized modifications to:

Critical System Files

Configuration

Application Files

where applicable to the PCI control design.

97. Monitoring Administrative Actions

High-risk activity:

Disable Logging

Change Retention

Delete Log Index

Change SIEM Rule

should itself be logged and monitored.

98. Monitoring Security Rule Changes

Example:

SIEM Detection Disabled
      ↓
Alert

using independent control paths where practical.

99. Third-Party Monitoring

If a managed security provider performs monitoring:

Organization
      +
Provider
      =
Monitoring Responsibility

Document exactly:

Who Reviews?

Who Investigates?

Who Escalates?

Who Retains Evidence?

100. Build Monitoring Responsibility Matrix

Create:

11 PCI Monitoring Responsibility Matrix

Use:

Activity	Internal SOC	Provider	System Owner

101. Monitoring SLA

Define response expectations.

Example:

Severity	Initial Review
Critical	Immediate
High	30 Minutes
Medium	4 Hours
Low	Next Business Day

Actual targets should align with organizational incident procedures and risk.

102. Alert Aging

Track:

Unassigned Alerts

Open High Alerts

Overdue Investigations

103. Monitoring Dashboard

Track:

Metric	Target
CDE Logging Coverage	100%
Critical Alerts Reviewed	100%
Daily Reviews Completed	100%
Log Sources Healthy	100%
Time Synchronization	100%
Required Retention Met	100%

104. Logging KPI

Example:

Percentage of in-scope CDE systems
sending required logs
to centralized monitoring

Target:

100%

105. Monitoring KPI

Example:

Percentage of required PCI security alerts
reviewed within defined SLA

106. Logging KRI

Example:

CDE systems
not reporting to the central SIEM

Target:

107. Critical Alert KRI

Example:

Critical CDE security alerts
past investigation SLA

108. Retention KRI

Example:

PCI log sources
below required retention

109. Time Synchronization KRI

Example:

CDE systems
with time drift beyond approved tolerance

110. Logging Exception

Sometimes a system cannot provide required logging capability.

Create:

12 Logging Exception Register

Use:

System	Logging Gap	Risk	Compensating Control	Owner	Expiry

111. Exception Example

Legacy payment appliance:

Cannot Forward Logs to SIEM

Possible temporary mitigation:

Local Protected Logging

Frequent Collection

Restricted Administration

Enhanced Network Monitoring

while replacement is planned.

112. Exceptions Need Expiry

Do not allow:

Legacy Logging Exception
      ↓
Permanent

Use:

Owner

Migration Plan

Expiry

Periodic Review

113. Logging Testing

A practical control test:

CDE Asset Population
      ↓
Select Sample
      ↓
Generate Event
      ↓
Confirm Local Log
      ↓
Confirm Central Collection
      ↓
Confirm Timestamp
      ↓
Confirm Alert if Required

114. Build PCI Logging & Monitoring Testing Checklist

Create:

13 PCI Logging & Monitoring Testing Checklist

For each sampled system:

Audit logging enabled.
User identity captured.
event type captured.
timestamp captured.
source captured.
success/failure captured where applicable.
logs centrally collected.
log integrity protected.
correct retention configured.
time synchronized.
critical events monitored.

Generate:

Failed Administrative Login

Verify:

System Log
      ↓
SIEM
      ↓
Detection

116. Test — Privileged Change

Create controlled test:

Add Test User
to Admin Group

Verify:

Privilege Change Logged
      ↓
Alert Generated

if the monitoring use case requires alerting.

117. Test — Logging Disabled

In an approved test environment, simulate:

Logging Agent Stops

Expected:

Collection Health Alert

118. Test — Firewall Change

Approved test:

Firewall Rule Modified

Verify:

Audit Event

Change Record

Monitoring

119. Test — Retention

Select log from:

11 Months Ago

Verify it can be retrieved if within required retention.

120. Test — Immediate Availability

Select log from:

Previous Month

Verify it is readily available for analysis.

121. Logging Finding — Missing Source

Three payment servers do not send operating-system security logs to the central SIEM.

Risk:

CDE Activity
May Go Undetected

122. Logging Finding — Short Retention

Database audit logs are retained for only 60 days.

Potential result:

Retention Gap

123. Logging Finding — No Review

CDE security logs are collected, but no documented daily review or automated equivalent monitoring process exists for required events.

124. Logging Finding — Time Drift

Five network devices differ from the approved time source by more than 30 minutes.

125. Logging Finding — Shared Account

Payment database audit logs show all administrator activity under one shared DBA account.

Risk:

Individual Accountability Lost

126. Logging Finding — Sensitive Data

Application-debug logs contain full PAN values.

Potential impact:

Unnecessary CHD Storage

Expanded PCI Scope

Data Exposure Risk

127. Logging Finding — SIEM Admin

CDE administrators can delete security logs from the central monitoring platform without independent approval.

128. Build Logging Gap Register

Create:

14 PCI Logging & Monitoring Gap Register

Use:

Gap	System	Risk	Severity	Owner

129. Root Cause Example — Missing Logs

Problem:

3 Payment Servers
Not Reporting

Why?

Log Agent Not Installed

Why?

Servers Built Manually

Root cause:

Central logging configuration is not enforced through the approved CDE server baseline.

130. Correction

Install Logging Agent

131. Corrective Action

Update Golden Image

Automatically Validate Log Coverage

Alert on Missing Sources

132. Root Cause Example — Short Retention

Problem:

Logs Retained 60 Days

Why?

Storage Cost Reduction

Why?

PCI Retention Requirement
Not Included in SIEM Design

Root cause:

PCI log-retention requirements were not incorporated into centralized logging architecture.

133. Corrective Action

Extend Retention

Add Archive Tier

Monitor Retention Policy

134. Root Cause Example — PAN in Logs

Problem:

PAN Appears in Debug Logs

Why?

Application Logs Entire Request Body

Root cause:

Secure software logging standards do not prohibit payment-data logging or enforce redaction.

135. Corrective Action

Stop Full Request Logging

Mask / Redact PAN

Delete Unnecessary Historical CHD

Update Coding Standard

Add Automated Testing

136. Practical Activity — Build CDE Logging Inventory

Use fictional organization:

CloudShop

Include:

Payment Web

Payment API

Payment Database

Firewall

WAF

Identity Provider

Jump Host

Cloud Platform

Kubernetes

SIEM

For each identify:

Events

Destination

Retention

Owner

137. Practical Activity — Build Critical Event Catalog

Include at least:

Failed Admin Login

New Administrator

MFA Disabled

Logging Disabled

Firewall Change

Database Export

Malware Alert

CDE Connectivity Violation

Assign severity.

138. Practical Activity — Logging Coverage Review

CDE inventory:

50 Assets

Central logging:

46 Assets

Gap:

Determine:

Which Systems?

Why Missing?

Risk?

Correction?

Corrective Action?

139. Practical Activity — Daily Log Review

Assume one day generates:

12 High Alerts

55 Medium Alerts

240 Low Alerts

Prioritize review and document:

Reviewed

Escalated

Closed

Incident Created

140. Practical Activity — Time Synchronization

Review:

30 CDE Systems

Results:

27 Synchronized

3 Have 20–45 Minute Drift

Determine:

Risk

Root Cause

Correction

141. Practical Activity — Retention Review

Systems:

Firewall:
365 Days

Application:
365 Days

Database:
60 Days

IAM:
400 Days

Identify the retention gap.

142. Practical Activity — PAN in Logs

Application log contains:

customer=Alice

pan=4111111111111111

status=approved

Document:

Immediate Containment

Scope Impact

Data Removal

Root Cause

Corrective Action

143. Practical Activity — Build SIEM Monitoring Matrix

Create detection rules for:

New Privileged Account

Repeated Authentication Failure

Logging Disabled

Public CDE Security Group

Unexpected Database Access

Bulk Payment Data Query

144. Practical Activity — Test Logging

Perform a fictional test:

User:
test-admin

Action:
Failed Login

Expected:

System Log
      ↓
SIEM
      ↓
Alert
      ↓
Analyst Review

Document every step.

145. PCI Logging & Monitoring Checklist

Coverage

All relevant CDE systems identified.
log sources inventoried.
centralized logging coverage reconciled.
missing sources investigated.

Audit Events

authentication logged.
failed authentication logged.
privileged activity logged.
account changes logged.
security-control changes logged.
significant data-access events logged where applicable.

Log Content

user identity captured.
event type captured.
timestamp captured.
source captured.
result captured.
target information captured where applicable.

Central Collection

logs forwarded centrally.
ingestion monitored.
missing-source alerts implemented.
platform access restricted.

Monitoring

critical events defined.
detection rules established.
alert owners assigned.
alert severity defined.
investigation workflow established.

Review

required daily reviews performed.
automated mechanisms validated.
review evidence retained.
exceptions documented.

Time

approved time sources defined.
CDE systems synchronized.
time changes restricted.
drift monitored.

Retention

applicable log-retention requirements met.
recent logs immediately available.
archived logs recoverable.
retention configuration reviewed.

Protection

logs protected from unauthorized modification.
deletion restricted.
privileged log-platform access controlled.
integrity monitored.

Sensitive Data

full PAN not unnecessarily logged.
SAD not logged.
passwords not logged.
secrets not logged.

Exceptions

logging gaps documented.
risk assessed.
compensating controls documented.
owners assigned.
expiry defined.

Testing

logging tested.
central forwarding tested.
alerting tested.
time synchronization tested.
retention tested.

146. Common PCI Logging & Monitoring Mistakes

Mistake 1 — Logs Exist, So Requirement Is Met

Nobody reviews or analyzes them.

Mistake 2 — SIEM Coverage Assumed

Some CDE systems are not sending logs.

Mistake 3 — Security-Control Failures Are Not Monitored

Logging stops silently.

Mistake 4 — Authentication Is Logged but Privilege Changes Are Not

Administrative risk remains hidden.

Mistake 5 — Logs Retained Too Briefly

Historical investigations become impossible.

Mistake 6 — Different System Clocks

Incident timelines cannot be reconstructed reliably.

Mistake 7 — CDE Administrators Can Delete Audit Evidence

Log integrity is weak.

Mistake 8 — Full PAN Appears in Logs

Logging itself creates additional CHD exposure.

Mistake 9 — Cloud Control-Plane Logs Are Ignored

Critical configuration changes are invisible.

Mistake 10 — Daily Review Is a Checkbox

No meaningful evidence of analysis exists.

147. Weak Logging Model

Systems
      ↓
Local Logs
      ↓
Stored Until Disk Fills

148. Strong Logging Model

CDE Systems
      ↓
Security-Relevant Events
      ↓
Centralized Collection
      ↓
Protected Storage
      ↓
Time Synchronization
      ↓
SIEM Analytics
      ↓
Alerting
      ↓
Analyst Review
      ↓
Investigation
      ↓
Incident Response
      ↓
Retention

149. GRC Analyst Responsibilities

A GRC professional supporting PCI logging and monitoring may:

Maintain the logging standard.
Maintain the CDE log-source inventory.
Reconcile logging coverage.
Maintain the critical-event catalog.
Review SIEM monitoring coverage.
coordinate daily review evidence.
review log-retention configuration.
review time-synchronization evidence.
track logging exceptions.
monitor missing log sources.
coordinate logging-control testing.
track remediation.
maintain evidence.
support assessor requests.

GRC connects:

Security Operations

SIEM Engineering

Infrastructure

Cloud

Network

Database Teams

Application Engineering

IAM

DevOps

Incident Response

Assessors

150. Logging & Monitoring Maturity Model

Level 1 — Local Logging

Systems
      ↓
Local Audit Files

Level 2 — Centralized

Central Log Platform

Basic Review

Level 3 — Monitored

SIEM

Detection Rules

Alert Investigation

Level 4 — Automated

Automated Coverage Monitoring

Correlation

SOAR

Policy Alerts

Level 5 — Continuous Security Assurance

Real-Time Detection

Behavior Analytics

Automated Investigation

Continuous Control Validation

151. PCI Logging & Monitoring Mindset

For every CDE system ask:

What events does it log?

Are successful logins visible?

Are failed logins visible?

Are privileged changes visible?

Can we identify the individual user?

Are timestamps accurate?

Where are the logs sent?

Can administrators modify them?

How long are logs retained?

Are recent logs immediately available?

Who reviews them?

Which events trigger alerts?

What happens if logging stops?

Can we detect security-control changes?

Could the logs accidentally contain PAN or secrets?

Can we reconstruct an incident from these records?

For every detection rule ask:

What attack or control failure
is this designed to detect?

For every alert ask:

Who owns the investigation?

When these questions can be answered consistently, logging becomes an operational security control rather than simply an audit-evidence repository.

Key Takeaways

Logging records activity; monitoring identifies events that require attention.
PCI logging should provide accountability across important CDE activity.
Complete CDE log-source coverage is essential.
Operating systems, applications, databases, IAM, cloud platforms, network devices, Kubernetes, and security tools may all provide relevant logs.
Centralized logging improves correlation, retention, protection, and investigation.
Critical events should be explicitly defined and monitored.
Required log reviews should be demonstrable rather than informal.
Automated monitoring can improve scale but still requires ownership and investigation.
Time synchronization is essential for accurate incident reconstruction.
Logs should be protected against unauthorized modification and deletion.
PCI DSS v4.x commonly requires at least 12 months of audit-log history, with at least three months immediately available for analysis, where the applicable requirement applies.
Logging platforms should not unnecessarily store full PAN, SAD, passwords, or secrets.
Logging failures themselves should be detected.
Cloud, containers, Kubernetes, and CI/CD environments require modern logging strategies.
Logging exceptions should be risk assessed, compensated, owned, and time-bound.
GRC coordinates logging coverage, evidence, retention, testing, exceptions, and assessor support.

Knowledge Check

Before continuing, make sure you can answer:

What is the difference between logging and monitoring?
Why should CDE log coverage be reconciled against the asset inventory?
What information should an effective audit trail contain?
Why are failed authentication events important?
Why should privileged changes be monitored?
Why is centralized logging useful?
What does a SIEM do?
What is a critical-event catalog?
Why should logging failures generate alerts?
What is the purpose of daily log review?
How can automated monitoring support PCI?
Why is time synchronization important?
How should logs be protected?
What are typical PCI DSS log-retention expectations?
Why should recent logs remain immediately available?
Why is full PAN in application logs a problem?
Why are cloud management logs important?
Why are Kubernetes audit logs important?
How should logging exceptions be managed?
What role does GRC play in PCI logging and monitoring?

What’s Next?

➡️ Next: 09 — Security Testing

In the next lesson, you will move from monitoring the CDE into actively validating whether security controls and boundaries can withstand attack.

You will work through:

CDE Scope
      ↓
Internal Vulnerability Scanning
      ↓
External ASV Scanning
      ↓
Application Security Testing
      ↓
Penetration Testing
      ↓
Segmentation Testing
      ↓
Wireless Security Testing
      ↓
Findings
      ↓
Remediation
      ↓
Retesting
      ↓
Evidence

You will also build practical artifacts including a PCI Security Testing Strategy, PCI Testing Calendar, Penetration Test Scope, Segmentation Test Plan, ASV Scan Tracker, Application Security Testing Register, Wireless Security Review Register, Security Testing Findings Register, Retest Tracker, and PCI Security Testing Evidence Package.