PCI-DSS Requirement 10.7 mandates a minimum of one year of audit trail history, with at least three months immediately available for analysis. Many organizations retain for longer based on other regulatory requirements.