What time metadata must be included in audit logs for system components?

• A. Date and time stamp are included in log entries
• B. Type of event is included in log entries
• C. User role
• D. Data classification

Answer: (B)

What you need in an audit log to understand what happened is a clear description of the action that occurred. The type of event provides that essential descriptor, labeling the exact action recorded in the log entry—such as a login attempt, a file access, or a configuration change. Without knowing the event type, a timestamp alone only tells you when something happened, not what happened, which makes it much harder to interpret the log and respond to incidents. In PCI DSS practice, logs should include timestamps to establish timing, but the event type is the key piece of metadata that explains the action captured. Other fields like user role or data classification can be helpful, but they don’t define the action itself.