← PCI DSS 4.0.1 · Req 10 — Log and monitor

10.5.1 — Audit log history retained for 12 months

medium loggingdata-retention

Requirement

Audit log history is retained for at least 12 months, with at least the most recent three months immediately available for analysis, and logs are protected from destruction and unauthorised modification.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

audit logaudit logslogslog historylog data

Required element 2 — any one of

12 monthstwelve monthsone year1 year13 monthsretain…retention

Supporting terms — specificity signals

10.5.1three months3 monthsimmediately availableimmutabletamper

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

logs are kept for 30 days logs are retained for 30 days logs are not retained

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.5(1)(e)	Storage limitation	data-retention
CCPA/CPRA	1798.100(a)-(b)	Notice at collection	data-retention
SOC 2	CC2.1	Quality information for internal control	logging
SOC 2	C1.2	Disposal of confidential information	data-retention
ISO 27001	A.8.10	Information deletion	data-retention
ISO 27001	A.8.15	Logging	logging
HIPAA	164.312(b)	Audit controls (R)	logging
GLBA	314.4(c)(8)	Monitoring and logging of authorised user activity	logging