| PCI-REQ-10.2-LOG-ACCESS | Payment API access is audited | pass | matched api_access_log artifact b4cdcb06-0b2d-4faf-8b4d-11af26e70508 |
| PCI-REQ-10.2-LOG-ADMIN | Privileged admin actions are logged | pass | matched api_access_log artifact b4cdcb06-0b2d-4faf-8b4d-11af26e70508 |
| PCI-REQ-10.3-LOG-FIELDS | Audit log fields meet minimum detail | pass | matched api_access_log artifact b4cdcb06-0b2d-4faf-8b4d-11af26e70508 |
| PCI-REQ-10.4-LOG-REVIEW | Security log review is evidenced | pass | matched control_test_result artifact ff3e7389-891a-45b4-b2e6-b93655b360d5 |
| PCI-REQ-10.5-LOG-INTEGRITY | Audit log integrity controls enabled | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-10.6-TIME-SYNC | Time synchronization enabled for correlation | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-10.7-LOG-RETENTION | Audit log retention meets policy minimum | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-7.2-ACCESS-RBAC | Role-based access control enforced | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-8.2-AUTH-MFA | Admin MFA required | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-8.3-AUTH-STRONG | Strong service authentication modes | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-8.6-API-AUTH | Payment API calls are authenticated | pass | matched api_access_log artifact b4cdcb06-0b2d-4faf-8b4d-11af26e70508 |
| PCI-REQ-6.5-CHANGE-MGMT | Payment stack changes are recorded | gap | control_test_result fail: No change_record artifact ingested in last 30 days for payment-api |
| PCI-REQ-6.3-SECURE-CHANGE | Production deploys require approval evidence | gap | control_test_result fail: Approval-gate sampling failed: last 2 deploys missing approved_by distinct from author |
| PCI-REQ-6.4-VULN-MGMT | Vulnerability management process evidenced | gap | control_test_result fail: Vuln tracker integration not connected; cannot prove criticals tracked |
| PCI-REQ-11.3-VULN-SCAN | Vulnerability scan results are fresh | gap | control_test_result fail: last_scan_at older than 90 days or missing in demo tenant |
| PCI-REQ-4.2-TLS-CONFIG | TLS configuration uses strong protocols | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-3.5-ENC-REST | Encryption at rest enabled for sensitive stores | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-2.2-SECURE-CONFIG | Secure baseline configuration applied | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |
| PCI-REQ-12.10-INCIDENT-LOG | Security incidents are logged and linkable | pass | matched api_access_log artifact b4cdcb06-0b2d-4faf-8b4d-11af26e70508 |
| PCI-REQ-1.2-NET-SEGMENT | Payment tier network posture documented | pass | matched config_snapshot artifact 7e3a263b-4b78-4a92-bac7-76b1936c6f35 |