I am with an organization that is just starting to work on PCI. We have 3 sites that are connected via point to point connections. Only the main site stores the card holder data. The other two sites have workstations that connect to the card holder data environment via encrypted connection. We need all 3 sites to be PCI compliant.
Based on the information above, I have a few questions...
Do we need a separate SAQ for each site? Or just for the main site?
We understand that the 2 sites that do not store card holder data are in scope, however, do we just need to harden those environments or do we need to go through each PCI requirement and ensure it is met? We understand we have to do that for the main site.
We understand that risk assessment is requirement for the PCI. Since we are just implementing it, when should we conduct a risk assessment? At the beginning when we define the scope or at some later time?
Should we go through the SAQ to see where we stand (gap analysis) before or after the risk assessment?
Thank you very much for your help!!!