Antivirus log retention should be in accordance with which PCI DSS requirement?

• A. 9.7
• B. 10.7
• C. 12.3
• D. 4.6

Answer: (B)

Retention of audit logs is a key part of PCI DSS for enabling security monitoring and incident response. Antivirus logs are part of those audit trails, so they must be kept in a way that supports investigation and forensics. The requirement that governs this is the rule that auditors expect: keep audit trails for at least one year, with the most recent three months readily available for analysis. This timing ensures you can trace malware events, correlate related alerts, and conduct timely investigations.

Other options point to different security controls (such as how access is managed, how systems are configured, or how changes are tracked) but they do not specify the duration for retaining logs. Thus they don’t address antivirus log retention.