Which PCI DSS requirement is explicitly cited for logging and audit trails in the context of cardholder data environments?

• A. Requirement 2
• B. Requirement 10
• C. Requirement 9
• D. Requirement 7

Answer: (B)

Tracking and monitoring access to cardholder data through logs and audit trails is essential for detecting unauthorized activity and guiding incident response. PCI DSS requires regular tracking and monitoring of all access to network resources and cardholder data, implementing audit trails, protecting those logs from tampering, and retaining them for a defined period. This explicit emphasis on logging and audit trails is what makes this requirement the correct focus.

Other options target different controls: one emphasizes physical security of systems, another specifies restricting access to cardholder data by job necessity, and the last focuses on removing vendor defaults. None of these center on the need to generate, protect, and retain logs for monitoring and auditing.