---
title: "Server controls for PCI DSS and GDPR | Wardio"
description: "File integrity monitoring and log retention are mandatory technical controls for small online stores. Here is which obligation each part of the stack answers."
source: "https://wardio.net/compliance/"
---

**Compliance controls**

# You may already be obliged to run these. Most small businesses don't.

If you take card payments, PCI DSS requires file integrity monitoring and log retention on systems in scope. If you hold customer data in the EU, GDPR Article 32 requires you to be able to restore it after an incident. Both are obligations you already carry.

## Which part of the stack answers which obligation

| Control | Obligation | Function | Tooling |
| --- | --- | --- | --- |
| File integrity monitoring | PCI DSS Requirement 11.5.2 | Detects unauthorised modification of critical files and alerts on change. Required where your server is in scope for 11.5.2, which includes SAQ A-EP and full assessments but not SAQ A. | Wazuh |
| Log collection and retention | PCI DSS Requirement 10 | Records access to system components and keeps those records, so you can reconstruct an incident afterwards. | Wazuh |
| Vulnerability detection | PCI DSS Requirement 6 / 11 | Continuously identifies unpatched packages and known CVEs on the host. | Wazuh |
| Security patching | PCI DSS Requirement 6.3 | Critical patches go on promptly, and rebootless kernel patching removes the usual excuse for delay. | KernelCare |
| Access control and segmentation | GDPR Art. 32 · PCI DSS Req. 1 & 7 | Admin access moves off the public internet onto a private mesh with per-device identity. | Tailscale |
| Availability and restoration | GDPR Art. 32(1)(c) | The ability to restore availability and access to personal data in a timely manner after an incident. In practice that means off-site backups with a documented, rehearsed restore procedure. An archive nobody has touched does not meet it. | Backups + integrity checks |

Wazuh publishes its own mappings to PCI DSS, GDPR, HIPAA, NIST 800-53 and TSC. The controls above come with ordinary server management. There is no separate compliance project.

## The distinction that matters

People often mix up two different things. **Implementing a control** means the monitoring is running, the logs are kept and the backups restore. **Certifying compliance** means an assessor has examined your whole environment and signed something.

Wardio does the first and cannot do the second. A one-person practice is not a QSA, and I would be lying if I implied otherwise. You get the technical half done properly, with evidence you can hand to whoever asks for it.

## Questions worth asking

### Does this make my business PCI DSS compliant?

No, and anyone who tells you otherwise is selling something. Compliance is a scope-wide assessment of your policies, your people, your payment flow and your systems. Wardio implements and evidences the technical server controls inside that scope: file integrity monitoring, log retention, patching and access control. That is a real part of the work, and most small merchants are missing it entirely. It is still not the whole obligation, and I am not an auditor.

### I use Stripe or Shopify. Does PCI DSS still apply to me?

Usually yes, at a reduced scope. A hosted payment provider lowers the self-assessment questionnaire you fall under. If your own server plays any part in the payment page, by redirecting to it, embedding it or serving the page that loads the payment script, the server-side requirements generally still apply to you. Ask your acquirer which SAQ they expect from you. It is the most useful question you can put to them.

### What about GDPR?

GDPR Article 32 requires security appropriate to the risk. The article names the ability to restore availability and access to personal data in a timely manner after an incident. In practice that means monitoring, access control and backups you have tested. Article 32 does not prescribe products, so nobody can sell you a GDPR-compliant server. Untested backups are still difficult to defend as appropriate measures.

### Can you produce evidence for an auditor or a client questionnaire?

Yes. I retain alert history, file integrity events, patch records and backup integrity check results, and you can export all of it. A customer security questionnaire is much easier to answer when the answers already exist and nobody has to reconstruct them.

[A free review](/contact/) tells you which of these controls your server has today. Most servers have none of them.