Question: Are group 2x devices required to comply to all PCI in-scope controls?
Short version: Not necessarily, but they could be... it's really up to the assessor. The use of categories is a way to make more persuasive arguments to your assessor when you want to determine if a device needs to comply to specific controls or not.
The category classification system that you're using - the Open PCI DSS Scoping Toolkit - clearly states:
We believe the Toolkit to be consistent with the spirit and intent of the PCI DSS.
However, the Toolkit is not endorsed by the PCI Security Standards Council in any way,
nor is it the product of an official Special Interest Group.
The PCI DSS itself has no concept of categories 1-3 or "infection"*. This paradigm got thrown out there by people who were sick of dealing with the incredibly ambiguous "connected" definition of scope the DSS actually uses. As far as the DSS is concerned, everything is either in- or out- of scope. And if it's in scope, "...PCI DSS security requirements apply..."
So in pure PCI DSS terms, if it's in scope, all requirements apply.
And if you look at the table in section 6.4 of the Open PCI DSS Scoping Toolkit, you'll see that 1a through 2x are all "in scope":
But wait! If you go on to read the "Frequently Asked Questions" in Appendix B of the Toolkit, it directly addresses your question (but might not answer it):
- 10.6 The Toolkit repeatedly states that for Category 2x system components, such as administrative workstations, not all PCI DSS controls are applicable or necessary. How does one determine which controls are required?
The answer: if you look at the access a 2x device has, its limitations, and its compensating controls, then you can make reasonable arguments that certain DSS requirements don't need to be applied. And if you can convince your assessor that you've got a good case, then you're all set. (This is true of any category device, by the way, but you'll never convince your assessor that a 1a device should be exempt from DSS 3.4)
I encourage you to read through the Open PCI DSS Scoping Toolkit, especially 5.5, 5.7, 6, and 10 ("Appendix B"). The same message is repeated throughout:
- Use the Toolkit to fine-grain scope,
- Use fine-grained scope to reach reasonable agreements with your assessor.
10.3 Why doesn’t the Toolkit specify which PCI DSS control requirements apply for each sub-category?
The Toolkit states that all applicable PCI DSS controls are required for Category 1 and
2a system components and that no PCI DSS controls are required for Category 3
However, because every organization and CDE is unique, it would impossible to provide
more specific guidance on which PCI DSS controls are required for every type of
Category 2b, 2c and 2x system component. The Toolkit does provide the basis for an
organization and its assessor to discuss what the relevant risks are and the controls
required to mitigate them.
* Personally, I believe that the choice of the word "infection" to describe scope transition among connected systems was a mistake; I don't know all the politics involved, but I'm reasonably confident that the PCI Security Standards Council will never put their stamp of approval on a document that makes PCI sound like a virus.