Which entry must be recorded to show which data, system component, or resource was affected by an event?

Which entry must be recorded to show which data, system component, or resource was affected by an event?

• A. Identity or name of affected data, system component, or resource
• B. Data owner
• C. Data security classification
• D. The user’s login time

Answer: (A)

In PCI DSS logging and audit trails, it’s essential to identify exactly which asset was impacted by an event. Recording the identity or name of the affected data, system component, or resource provides the concrete link between the incident and the item that was touched. This allows you to map events to specific assets, understand the scope of an incident, and reconstruct what happened for analysis and remediation. Data owner and data security classification describe governance and sensitivity but don’t tell you which asset was affected during an event. The user’s login time helps establish who acted and when, but it doesn’t indicate what data or component was impacted.

In PCI DSS logging and audit trails, it’s essential to identify exactly which asset was impacted by an event. Recording the identity or name of the affected data, system component, or resource provides the concrete link between the incident and the item that was touched. This allows you to map events to specific assets, understand the scope of an incident, and reconstruct what happened for analysis and remediation.

Data owner and data security classification describe governance and sensitivity but don’t tell you which asset was affected during an event. The user’s login time helps establish who acted and when, but it doesn’t indicate what data or component was impacted.