Payment Card Industry Data Security Standard

"Each individual user" is the hard half of this kind of requirement, not "audit trail". Most estates fail it at the connection-pool boundary, where twenty analysts arrive as one service account. Real-time SQL auditing resolves the database session, the OS user, the client host, and the application context on every statement, so access resolves to a person rather than to app_user. User behaviour analytics keeps that attribution useful over time by baselining what each identity normally does — which is how a shared credential looks different from a compromised one.

Most estates fail this at the connection-pool boundary, where many analysts arrive as one service account. What is resolved per statement is the database session, the OS user, the client host, and the application context.

A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.

A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.

Events are stamped from one synchronised source at the collector, so ordering across instances is reconstructable without reconciling timestamps host by host at audit time.

Retention obligations are easy to state and expensive to meet, because the cost is in keeping the record queryable rather than merely stored. Audit events land in columnar storage on immutable object storage, so a multi-year window costs object-storage prices and is still searchable in seconds when an examiner asks for a sample. Each record carries a verification hash, so what you produce years later is demonstrably what was written at the time.