Source: http://infosecisland.com/blogview/11309-Complete-PCI-DSS-Log-Review-Procedures-Part-12.html
Timestamp: 2019-07-22 18:43:41
Document Index: 194068144

Matched Legal Cases: ['art 1', 'art 2', 'art 3', 'art 4', 'art 5', 'art 6', 'art 7', 'art 8', 'art 9', 'art 10', 'art 11', 'art 1']

This is the twelfth post in the long, long series (part 1, part 2, part 3, part 4, part 5, part 6, part 7, part 8, Part 9, part 10, part 11). A few tips on how you can use it in your organization can be found in Part 1. You can also retain me to customize or adapt it to your needs.
Final and critical part of compliance-motivated log review is making sure that there is sufficient evidence of the process, its real-world implementation and diligence in following the log review process.
The good news here is that the same data can be used for management reporting about the logging and log review processes, so you are not doing just for PCI DSS compliance.
The critical item from the above list is “a logbook” that is used to record exception follow-up and investigation, thus creating powerful evidence of compliance with PCI DSS requirements.
In a more advanced form, the logbook can even grow into an investigative “knowledge base” that contains all past exception analysis cases.
Tags: PCI DSS Compliance Log Management Security Audits QSA Monitoring