Logging and Monitoring Policy
Logging, review, retention, and monitoring standards under PCI DSS Requirement 10.
Logging & Monitoring Policy (PCI DSS Requirement 10)
Updated: January 1, 2026
Approved By: Jennifer Lyssy, CEO
1. Purpose
This policy defines the requirements for logging, monitoring, and reviewing system activity to detect, prevent, and respond to security events and protect cardholder data.
2. Scope
Applies to all systems, applications, and personnel involved in storing, processing, or transmitting cardholder data.
3. Policy Statement
Botanic, LLC maintains logging and monitoring controls to detect unauthorized access, anomalies, and suspicious activity across all systems.
4. Roles and Responsibilities
Security Officer / IT Lead
Oversees logging and monitoring activities
Reviews logs and ensures remediation
Technical Personnel
Maintain logging systems
Investigate alerts and anomalies
5. Logging Requirements
Audit logs must be enabled for all systems and must capture:
User access to systems
Administrative actions
Failed login attempts
Changes to user accounts and privileges
System-level changes
Access to audit logs
Each log entry must include:
User ID
Event type
Date and time
Success or failure
Source of activity
6. Log Protection
Logs are restricted to authorized personnel
Logs are protected from modification
Logs are backed up securely
File integrity monitoring detects unauthorized changes
7. Log Review
Logs are reviewed at least daily for:
Security events
Critical systems
Servers and infrastructure
Automated monitoring tools may be used
All anomalies are investigated and resolved
8. Log Retention
Logs are retained for at least 12 months
At least 3 months must be immediately accessible
9. Time Synchronization
All systems use synchronized time (NTP/UTC)
Time settings are protected and monitored
10. Failure Detection
Failures of security systems (logging, IDS, firewalls, etc.) must:
Be detected and alerted
Be investigated
Be documented
Be remediated promptly
11. Policy Review
Reviewed annually and updated as needed.
12. Compliance
Failure to comply may result in disciplinary action.
