Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for approval code.

Does the PCI scope include the VX570 and the POS workstation? Note, no cardholder data stored in POS.

share|improve this question

Technically, all systems on the same network as the POS workstation are in scope. Any system on a network segment where cardholder data is stored, transmitted, or processed is in scope, not just the systems that actually store, process, or transmit the data.

see page 10 of the following:

The scope includes any system connected to the cardholder data environment. The cardholder data environment includes the network zones where cardholder data is stored, transmitted, or processed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.