In accordance with PCI DSS Requirement 10, how long must audit logs be retained?

PerRequirement 10.5.1.2, audit logs must be retained forat least one year, and the mostrecent three months must be readily availablefor analysis. This ensures traceability of security events over both short and longer-term periods.

Option A:✅Correct. Matches both duration and availability criteria.

Option B:❌Incorrect. Two years is not required.

Option C:❌Incorrect. The retention period is misstated.

Option D:❌Incorrect. One month is insufficient for immediate access.