How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards are already being met?
If I take the categorizes listed at face value backup servers need to be treated as category 1a. The repercussion would be that I couldn't backup my isolated class 3 servers from this backup server. If these files can be treated as files only and not as cardholder data proper the flow diagram makes more sense. Backup servers would be capable of being treated as a 2b device and capable of backing up category 1 and 3 boxes.
The second option sounds like more of what is intended in the reqs themselves since there is no mention of segregation in the primary requirements document, just that the backups be secured encrypted etc. It seems counter-intuitive that we'd need an independent backup system and tape library just for this so I'd love someones insight that has been doing this longer than I.