My organisation is now using tokenisation and we are no longer storing any credit card information.
I now think I may no longer need some of the following controls:- (there may be others although these are the main ones)
11.1 - Test for the presence of wireless access points and detect unauthorized wireless access points on a quarterly basis.
** No longer needed as Wifi is not allowed in my environment and the tokenisation server is in a DC** 11.2 - Run internal and external network vulnerability scans at least quarterly......
** Looking at reducing my external PCI-DSS scanning costs and to just continue using external vulnerability assessment tools** 11.3 Perform external and internal penetration testing at least once a year.....
I would descope the PCI-DSS systems from the pen-test if required. (Something that I would not do anyway)
What are your thoughts? Can you greatly descope once you are using tokenisation?
- Wireless will not be connected the the card holder data environment. - I will still need controls on the tokenisation system including the ones I mentioned above. - If the tokenisation system is in my DMZ with other servers all that have a routable IP address, will this mean all those systems will fall under the CDE and will still need to be scanned as part of 11.2 and 11.3?
The QSA that works with out company is telling us that everything is still in scope for PCI-DSS. He has recently added our email server into the CDE scope as employees send their personal or corporate credit card numbers via email when they order flowers or flights. Thoughts? The email server issue is something I'll fix via policy.
My friend who is a QSA said yes descope and you may no longer need some controls. What exactly, I'm not sure at this point in time.
PCI says "Tokenization solutions do not eliminate the need to maintain and validate PCI DSS compliance, but they may simplify a merchant’s validation efforts by reducing the number of system components for which PCI DSS requirements apply"
"Tokenization systems and processes must be protected with strong security controls and monitoring to ensure the continued effectiveness of those controls"