I'm fully up to speed on PCI DSS requirements and have attend the ISA course recently. The course was helpful and I was able to bounce ideas off of the trainer. However I keep coming back to one aspect of PCI for which I need to decide if at this stage if it's applicable or if anyone else has gone down this route: vulnerability scans.
I have got the impression that if I can prove that the card data in our environment is fully encrypted from the PIN pad to our transaction handler and there is no way anyone could hack that or retrieve the decryption keys or even be able to influence the transaction, then a vulnerability scan will not add any security. (However I do see the point of vulnerability scans from a general security stand point.) It's a cost and time thing at the moment.
The setup (merchant Level 2 - SAQ C):
Multiple sites, segmented and not connected together via VPN/LAN/etc. All standalone sites. We use a PCI DSS Level 1 Card transaction handler and use their software and industry standard PCI-compliant PIN pads. The data is encrypted within the device and then transmitted. We have no access to the data or other information other than the last four digits after the transaction has been processed.
We currently have quarterly external penetration tests performed by an ASV.
With the encryption and access, does anyone feel I can de-scope the vulnerability scans?