You may already be obliged to run these. Most small businesses aren't.
If you take card payments, PCI DSS requires file integrity monitoring and log retention on systems in scope. If you hold customer data in the EU, GDPR Article 32 requires you to be able to restore it after an incident. These are not best practices. They are obligations.
Which part of the stack answers which obligation
| Control | Obligation | What it does | Tooling |
|---|---|---|---|
| File integrity monitoring | PCI DSS Requirement 11.5 | Detects unauthorised modification of critical files and alerts on change. Required for merchants handling cardholder data. | Wazuh |
| Log collection and retention | PCI DSS Requirement 10 | Records and retains access to system components so an incident can actually be reconstructed afterwards. | Wazuh |
| Vulnerability detection | PCI DSS Requirement 6 / 11 | Continuously identifies unpatched packages and known CVEs on the host. | Wazuh |
| Security patching | PCI DSS Requirement 6.3 | Critical patches applied promptly. Rebootless kernel patching removes the usual excuse for delay. | KernelCare |
| Access control and segmentation | GDPR Art. 32 · PCI DSS Req. 1 & 7 | Admin access moves off the public internet onto a private mesh with per-device identity. | Tailscale |
| Availability and restoration | GDPR Art. 32(1)(c) | Ability to restore availability and access to personal data in a timely manner after an incident, which means off-site backups with a documented, rehearsed restore procedure rather than an untouched archive. | Backups + integrity checks |
Wazuh publishes its own mappings to PCI DSS, GDPR, HIPAA, NIST 800-53 and TSC. The controls above are delivered as part of ordinary server management, not as a separate compliance project.
The distinction that matters
There are two different things and they get conflated constantly. Implementing a control means the monitoring is running, the logs are retained, the backups restore. Certifying compliance means an assessor has examined your whole environment and signed something.
Wardio does the first. It does not and cannot do the second. A one-person practice is not a QSA and I would be lying if I implied otherwise. What you get is the technical half done properly, and evidence you can hand to whoever asks for it.
Questions worth asking
Does this make my business PCI DSS compliant?
No, and anyone who tells you otherwise is selling something. Compliance is a scope-wide assessment covering your policies, your people, your payment flow and your systems. What Wardio does is implement and evidence the technical server controls inside that scope: file integrity monitoring, log retention, patching, access control. That is a meaningful part of the work and it is the part most small merchants have missing entirely, but it is not the whole obligation and I am not an auditor.
I use Stripe or Shopify. Does PCI DSS still apply to me?
Usually yes, at a reduced scope. Using a hosted payment provider lowers which self-assessment questionnaire you fall under, but if your own server is involved in the payment page at all (redirecting, embedding, or serving the page that loads the payment script), you are generally not exempt from server-side requirements. Check which SAQ your acquirer expects from you; it is the single most useful question to ask them.
What about GDPR?
GDPR Article 32 requires security appropriate to the risk, and explicitly names the ability to restore availability and access to personal data in a timely manner after an incident. In practice that means monitoring, access control and backups you have actually tested. It does not prescribe products, so nobody can sell you a GDPR-compliant server, but untested backups are difficult to defend as appropriate measures.
Can you produce evidence for an auditor or a client questionnaire?
Yes. Alert history, file integrity events, patch records and backup integrity check results are all retained and exportable. Answering a customer security questionnaire is much easier when the answers already exist rather than being reconstructed.
A free review tells you which of these controls your server has today. Most have none of them.