Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function'

we have a webserver with database - web pages and email

is this a breach of the rules? because just about all web servers come with a database, web server and email. We are only a very small merchant with a very small web shop i can't imagine everyone is splitting all these up into 3 servers? this would be very expensive?

2.2.1 Implement only one primary function per server to prevent functions that require different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)

For example:

A database, which needs to have strong security measures in place, would be at risk sharing a server with a web application, which needs to be open and directly face the Internet. Failure to apply a patch to a seemingly minor function could result in a compromise that impacts other, more important functions (such as a database) on the same server.

This requirement is meant for all servers within the cardholder data environment (usually Unix, Linux, or Windows based). This requirement may not apply to systems which have the ability to natively implement security levels on a single server (e.g. mainframe).

I had a look at PCI-DSS - one application per server? but im still confused

share|improve this question

2 Answers 2

Yes, they should be separate servers.

However, they don't need to be separate physical servers; they can be three virtual servers on one physical server.

There is some room for debate in the standard. Separating web and database is pretty much non-negotiable. But if email is a minor function - say, the web server just uses it to send the odd email notification - then you may be able to justify combining that with the web server. If you were large your QSA would guide on this, but given your size I expect you are on self assessment.

share|improve this answer
+1 for discussing how the requirement can be negotiable. There is definitely a sliding scale. Functions that listen on the network should be closely evaluated. –  freb Feb 5 at 0:18

Yes, this is bad.

One primary application per server would mean that, given the functions you've listed, you would have three servers. One web server, one mail server, one database server. In fact, given that you're in a PCI environment and assuming that you are storing PCI data in the database, the database cannot be on a system that is able to communicate directly with the Internet. Obviously, aside from the single function requirement, this prevents putting the database on either a web or mail server.

A web server can certainly have syslog, ssh and other services running... These services are there because the primary service, the web service, requires them, in addition to the logging and management requirements for the organization.

A great way to figure out if you are meeting this requirement is to ask yourself this question: "If I removed this service from here and installed it on another system in the environment, could this system still achieve its goals?" If the answer is yes, then that service should be moved off of the server.

Hope this helps!

share|improve this answer
Im not actually storing credit card details in the database, the credit card payments are taken on a 3rd party site (payment gateway) Sagepay, do I still need to split everything up? –  user1398287 Feb 5 at 13:25
If your PCI web application is interacting with it then it would be in scope for a QSA provided that your web application is handling PCI data. If you are pushing the user to sage pay and never touching any of the cardholder data yourself (not just the card number) then you are likely ok. Still, multiple services on a single box is very bad practice. –  David Hoelzer Feb 6 at 1:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.