Can you provide clarification for logging/audit trail per PCI DSS requirements 10.2.5 and 10.2.6?
PCI DSS requirement 10.2.5 requires organizations to log the use of identification and authentication mechanisms, which are typically used by administrators. These mechanisms include (but are not limited to activities such as: 1. Adding and deleting user IDs; 2. Assigning user IDs to tokens; and, 3. Adding and deleting tokens PCI DSS requirement 10.2.6 requires organizations to log each instance where the audit log is initialized (started or stopped) to ensure a malicious user is not covering his/her actions or events by stopping or starting logging.