For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the final stages of the process.

This means it is also time to begin making final investments into hardware needed to be PCI complaint, which brings me to the question of what servers are needed to support the CDE.

After reading the requirements, books, and re-reading the requirements a handful of times, I have compiled this list of servers needed to support to CDE:

• Proxy Server (Requirement 1.3.3, Backoffice PC which are connected to the CDE and need access to webpages)
• File-Integrity Monitoring Server (Requirements 10.5.5 & 11.5)
• Syslog Server (Requirements 10.5.3 & 10.5.4)

Additionally, there are servers not specifically listed as a PCI requirement, but aid in the compliance process

• Active Directory Server (GPO Management, User authentication, etc.)
• Data Loss Prevention Software

Now with all of this said, my question is whether or not this assessment falls in line with anyone's experience with PCI compliance.

As per, requirement 2.2.1, each server needs to have only one primary function which means I would need to get five servers based on this assessment (or get a server capable of virtualizing these servers).

Does this all seem to make sense or am I missing something? Any suggestions or further questions are welcome.

Regards

For the past year and a half now, I've been working as the sole individual at a small retail hardware store trying to attain proper (read: not checkbox) compliance, and I am beginning to enter the final stages of the process.

This means it is also time to begin making final investments into hardware needed to be PCI compliant, which brings me to the question of what servers are needed to support the CDE.

After reading the requirements, books, and re-reading the requirements a handful of times, I have compiled this list of servers needed to support to CDE:

• Proxy Server (Requirement 1.3.3, Back Office PC which are connected to the CDE and need access to web pages)
• File-Integrity Monitoring Server (Requirements 10.5.5 & 11.5)
• Syslog Server (Requirements 10.5.3 & 10.5.4)

Additionally, there are servers not specifically listed as a PCI requirement, but aid in the compliance process

• Active Directory Server (GPO Management, User authentication, etc.)
• Data Loss Prevention Software

Now with all of this said, my question is whether or not this assessment falls in line with anyone's experience with PCI compliance.

As per, requirement 2.2.1, each server needs to have only one primary function which means I would need to get five servers based on this assessment (or get a server capable of virtualizing these servers).

Does this all seem to make sense or am I missing something? Any suggestions or further questions are welcome.