| PCI-REQ-10.2-LOG-ACCESS | Payment API access is audited | pass | matched api_access_log artifact 85178386-cea7-46c4-bede-3d16b5a8dbae |
| PCI-REQ-10.2-LOG-ADMIN | Privileged admin actions are logged | pass | matched api_access_log artifact 85178386-cea7-46c4-bede-3d16b5a8dbae |
| PCI-REQ-10.3-LOG-FIELDS | Audit log fields meet minimum detail | pass | matched api_access_log artifact 85178386-cea7-46c4-bede-3d16b5a8dbae |
| PCI-REQ-10.4-LOG-REVIEW | Security log review is evidenced | pass | matched control_test_result artifact e9d33c94-50f4-4a0d-a5fb-025258dc0546 |
| PCI-REQ-10.5-LOG-INTEGRITY | Audit log integrity controls enabled | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-10.6-TIME-SYNC | Time synchronization enabled for correlation | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-10.7-LOG-RETENTION | Audit log retention meets policy minimum | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-7.2-ACCESS-RBAC | Role-based access control enforced | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-8.2-AUTH-MFA | Admin MFA required | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-8.3-AUTH-STRONG | Strong service authentication modes | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-8.6-API-AUTH | Payment API calls are authenticated | pass | matched api_access_log artifact 85178386-cea7-46c4-bede-3d16b5a8dbae |
| PCI-REQ-6.5-CHANGE-MGMT | Payment stack changes are recorded | pass | matched control_test_result artifact e9d33c94-50f4-4a0d-a5fb-025258dc0546 |
| PCI-REQ-6.3-SECURE-CHANGE | Production deploys require approval evidence | pass | matched control_test_result artifact e9d33c94-50f4-4a0d-a5fb-025258dc0546 |
| PCI-REQ-6.4-VULN-MGMT | Vulnerability management process evidenced | gap | control_test_result fail: Vuln tracker integration not connected; cannot prove criticals tracked |
| PCI-REQ-11.3-VULN-SCAN | Vulnerability scan results are fresh | gap | control_test_result fail: last_scan_at older than 90 days or missing in demo tenant |
| PCI-REQ-4.2-TLS-CONFIG | TLS configuration uses strong protocols | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-3.5-ENC-REST | Encryption at rest enabled for sensitive stores | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-2.2-SECURE-CONFIG | Secure baseline configuration applied | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |
| PCI-REQ-12.10-INCIDENT-LOG | Security incidents are logged and linkable | pass | matched api_access_log artifact 85178386-cea7-46c4-bede-3d16b5a8dbae |
| PCI-REQ-1.2-NET-SEGMENT | Payment tier network posture documented | pass | matched config_snapshot artifact a415d312-6025-4bf5-8f23-4a89d593b738 |