Are audit logs retained for at least one year? Interview personnel Examine audit logs Are at least the last three months’ logs immediately Interview personnel available for analysis? Observe processes 10.8 This requirement applies only to service providers 10.9 Are security policies and operational procedures for Review security policies and monitoring all access to network resources and operational procedures cardholder data: Interview personnel Documented In use Known to all affected parties?
Are audit logs retained for at least one year? Interview personnel Examine audit logs Are at least the last three months’ logs immediately available for analysis? Interview personnel Observe processes 10.8 This requirement applies only to service providers 10.9 Are security policies and operational procedures for monitoring all access to network resources and cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx