Which activity concerning system-level objects must be auditable?

Which activity concerning system-level objects must be auditable?

• A. Creation and deletion of system-level objects.
• B. Access to user data.
• C. Viewing logs only.
• D. Installing software updates.

Answer: (A)

Auditing changes to system-level objects is essential because these objects define the system’s core configuration—things like user accounts, services, files, and other critical components. When someone creates or deletes a system-level object, it represents a meaningful change to how the system operates and security controls are enforced. Tracking these events provides a clear, auditable trail that helps detect unauthorized provisioning, removal of protections, or the introduction of persistence mechanisms. This visibility supports accountability, change management, and incident response, which are central to PCI DSS requirements. While auditing access to user data is important for privacy and data protection, it doesn’t directly address changes to the system’s foundational components. Viewing logs alone doesn’t capture changes to the system structure, and installing software updates, though important for security, is a process activity rather than an event about creating or deleting core system objects.

Auditing changes to system-level objects is essential because these objects define the system’s core configuration—things like user accounts, services, files, and other critical components. When someone creates or deletes a system-level object, it represents a meaningful change to how the system operates and security controls are enforced. Tracking these events provides a clear, auditable trail that helps detect unauthorized provisioning, removal of protections, or the introduction of persistence mechanisms. This visibility supports accountability, change management, and incident response, which are central to PCI DSS requirements.

While auditing access to user data is important for privacy and data protection, it doesn’t directly address changes to the system’s foundational components. Viewing logs alone doesn’t capture changes to the system structure, and installing software updates, though important for security, is a process activity rather than an event about creating or deleting core system objects.