Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for approval code.

Does the PCI scope include the VX570 and the POS workstation? Note, no cardholder data stored in POS.

share|improve this question
add comment

1 Answer

Technically, all systems on the same network as the POS workstation are in scope. Any system on a network segment where cardholder data is stored, transmitted, or processed is in scope, not just the systems that actually store, process, or transmit the data.

see page 10 of the following: https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

The scope includes any system connected to the cardholder data environment. The cardholder data environment includes the network zones where cardholder data is stored, transmitted, or processed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.