Which statement best describes logging requirements for cardholder data access?

Which statement best describes logging requirements for cardholder data access?

• A. Verify all actions by any user to cardholder data are logged.
• B. Verify all individual access to cardholder data is logged.
• C. Verify only failed attempts are logged.
• D. Verify access to cardholder data is not logged.

Answer: (B)

Tracking and monitoring access to cardholder data requires logging every individual access, creating an auditable record of who accessed what data and when. This allows you to prove accountability and quickly spot unauthorized activity. Logging only failed attempts would miss legitimate accesses, and logging every action by any user can be unnecessarily broad and noisy. Not logging access undermines the ability to investigate incidents or verify compliance. Therefore, the best approach is to log each individual access to cardholder data, including who accessed it, when, what data was accessed, where the access came from, and whether the access was successful.

Tracking and monitoring access to cardholder data requires logging every individual access, creating an auditable record of who accessed what data and when. This allows you to prove accountability and quickly spot unauthorized activity. Logging only failed attempts would miss legitimate accesses, and logging every action by any user can be unnecessarily broad and noisy. Not logging access undermines the ability to investigate incidents or verify compliance. Therefore, the best approach is to log each individual access to cardholder data, including who accessed it, when, what data was accessed, where the access came from, and whether the access was successful.