PCI DSS Log Retention: What to Keep and Why

Requirement 10.7 requires retaining audit logs for 12 months, with the most recent 3 months immediately available for analysis. The obligation sounds simple, yet merchants encounter several failure modes. Some stay hidden until a QSA requests logs that have already disappeared.

This article explains the requirement, common implementation gaps, and a compliant logging architecture for CDE systems under PCI DSS 4.0.

What PCI DSS Requirement 10 Requires

DSS 4.0 Requirement 10 covers CDE audit logs. Its core obligations include:

10.2.1 requires enabled audit logs that capture defined event types for CDE components. These include individual user access to cardholder data, root and privileged-user actions, access to or changes in audit logs, invalid logical access attempts, use of identification and authentication mechanisms, audit-log startup and shutdown, and creation or deletion of system-level objects.

10.5.1 requires retaining logs for at least 12 months, with the most recent 3 months available for immediate analysis. "Immediate" means access without restoration. Cold storage requiring a 24-hour retrieval period fails the three-month availability test.

10.4.1 requires reviewing logs from all critical system components at least daily. Automation, such as a SIEM alert for anomalous patterns, is acceptable, but evidence of review and action on alerts is still needed.

10.3.3 requires protecting audit logs from modification. This concerns integrity as well as retention. QSAs look for evidence that CDE administrators cannot alter or delete logs, and that changes to logs are logged themselves.

Two Common Log Retention Failures

The logging findings we see most often follow two patterns. Neither necessarily reflects negligence. Both usually reflect infrastructure growth that was not tracked against compliance requirements.

Storage migrations that quietly reset retention policies. A merchant moves logging from one platform to another, whose default retention differs. The team forwards sources to the new platform, confirms that new events arrive, and closes the project. Six months later, the old platform is retired. During the next audit, the QSA requests logs from 14 months earlier, but they are gone: the new platform kept its 90-day default, unnoticed because the migration focused on data flow rather than retention policy.

Prevent this during migration by verifying the destination retention policy before retiring the source. Continuous review of the oldest log timestamp can detect drift: if the oldest available log is newer than 12 months, retention is not operating as intended.

Cold storage that fails immediate availability. This failure is less obvious. A merchant retains 12 months of logs, with 30 days in hot storage, 30 to 90 days in warm storage, and 90 days to 12 months in cold storage requiring a ticket and 24 hours to restore. The 12-month requirement is met, but not the three-month immediate-availability test, because months two and three are in warm storage with multi-hour retrieval.

Organizations define "immediate" differently. The more defensible approach keeps the entire 90-day window in hot or warm storage retrievable within seconds or minutes. QSAs have discretion, but warm storage with a multi-hour SLA leaves a gray area best avoided during an audit.

Which Log Sources Are in Scope

Partial collection is another common gap: CDE application servers log, but connected systems do not. Requirement 10 follows the CDE scope. Every component in or connected to the CDE needs logging enabled and retained under the same policy.

That includes web application firewalls, load balancers, authentication systems such as RADIUS, LDAP, or directory services used by CDE systems, jump servers or bastion hosts, and virtualization layers or hypervisors managing CDE workloads. Organizations may classify these as infrastructure and omit them, but QSAs will ask about them.

Cloud environments add another layer. Provider audit logs, including AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs, are separate from instance-level operating system logs. Provider logs cover API actions and control-plane events; instance logs cover operating system events, authentication, and application activity. A complete CDE architecture considers both.

The Overlooked Log Integrity Control

Requirement 10.3.3 protects audit logs from modification or destruction, including by people with root or administrative access to CDE systems. Common approaches include write-once storage, append-only buckets, write-once file systems, or a SIEM managed separately from the CDE team.

The practical problem is that one team often administers both the CDE and its log platform. That creates a path for administrators to delete or alter logs. Requirement 10.3 addresses this by protecting the audit-log function from the people under review.

The clearest approach sends logs to a platform managed by a team without CDE administrative access, or to a managed SIEM where an API writes data that the sender cannot modify. If one team manages both services, add role separation, dual control for deletion, and logging for access to the log platform.

A Log Retention Architecture Under Review

A practical PCI DSS logging architecture centralizes all CDE sources on one collection platform; explicitly verifies and documents 12-month retention; keeps the first 90 days queryable within minutes; uses write-once or append-only archive storage; configures automated alerts for anomalous events under Requirement 10.4.1; and documents the path from source to final archive for QSA review.

Continuous monitoring helps confirm that this architecture remains intact. Systems enter the CDE, software updates change log formats, and network changes can quietly break forwarding. Verifying that expected sources send events and that archive retention has not drifted prevents failures that otherwise appear only during assessment.

We should be clear about what any monitoring platform, including PCIOasis, can show: active log sources, correctly configured retention, and expected log-volume ranges. It cannot independently establish forensic log integrity. Storage-layer architectural controls are required for that.

When Your QSA Requests Three Months of Logs

The final test is a simulation: choose a date 75 days ago and measure how long it takes to retrieve complete audit logs for every CDE component on that date. "Minutes" passes the immediate-availability test. "A ticket and tomorrow morning" does not. Run the test before your QSA asks.