Under A.1.3, who should be able to review logs?

• A. The owning entity
• B. Any merchant
• C. The hosting provider
• D. The public

Answer: (A)

The main idea is accountability for monitoring and reviewing logs in the cardholder data environment. Logs contain sensitive information about who accessed what and when, so the entity that owns and is responsible for cardholder data must be the one to review them. This ensures timely detection of unauthorized activity, supports incident response, and maintains proper access controls over sensitive data.

The owning entity has the legitimate need and obligation to monitor logs and enforce security, while a hosting provider or other parties may assist under a contract or shared responsibility model. Allowing the general public to review logs would expose sensitive information and undermine security. The option of “any merchant” is too broad and would weaken accountability.