What evidence do auditors commonly ask for on 10.5.1 Keep logs 12 months, latest three months online?

Audit log retention policy and procedure stating 12 months and three months online; SIEM hot storage and archive retention settings; Oldest available log entries per sampled source showing 12 months of history; Demonstration of querying or restoring logs from the last three months; Backup or archive restoration test records.

What is the most common gap auditors find on 10.5.1?

SIEM hot tier only keeps 30 or 90 days with no archive beyond

PCI DSS v4.0.1 · Req 10: Logging and Monitoring

`10.5.1` Keep logs 12 months, latest three months online

Audit log history must be kept for at least 12 months, and at least the latest three months must be ready for immediate analysis. Applies to all entities. The guidance explains that compromises often stay undetected for a long time, and gives storing logs online, archiving them or restoring them quickly from backup as examples of keeping logs immediately available. Customized approach objective: historical activity records can be used straight away to support incident response and are held for at least 12 months.

Source: PCI DSS v4.0.1, 10.5.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.

artefacts

held by a system

at each review

easy

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

SIEM hot storage and archive retention settings · SIEM / log platform
Oldest available log entries per sampled source showing 12 months of history · SIEM / log platform
Demonstration of querying or restoring logs from the last three months · SIEM / log platform
Backup or archive restoration test records · Backup / DR tooling

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Audit log retention policy and procedure stating 12 months and three months online · Policy repository / GRC workspace

First move

Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.

Common gaps auditors find

SIEM hot tier only keeps 30 or 90 days with no archive beyond
Archived logs exist but cannot be restored within a reasonable time
Some log sources rotate locally and are never sent to long-term storage

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

10.4.3 Exceptions and anomalies from log review addressed · 10.6.1 System clocks synchronized with time-sync technology