I am with an organization that is just starting to work on PCI. We have 3 sites that are connected via point to point connections. Only the main site stores the card holder data. The other two sites have workstations that connect to the card holder data environment via encrypted connection. We need all 3 sites to be PCI compliant.

Based on the information above, I have a few questions...

  1. Do we need a separate SAQ for each site? Or just for the main site?

  2. We understand that the 2 sites that do not store card holder data are in scope, however, do we just need to harden those environments or do we need to go through each PCI requirement and ensure it is met? We understand we have to do that for the main site.

  3. We understand that risk assessment is requirement for the PCI. Since we are just implementing it, when should we conduct a risk assessment? At the beginning when we define the scope or at some later time?

  4. Should we go through the SAQ to see where we stand (gap analysis) before or after the risk assessment?

Thank you very much for your help!!!

1 Answer 1


Quick answers from a mobile device:

  1. PCI is an organization-level commitment, so it is one per legal entity that has a CDE or merchant or processing agreement or other engagement with cards.

  2. Not really either of those, but the latter is closer. Each requirement has to be met across the full scope. That one ordinarily does IT planning on a per site basis is immaterial.

    It sounds like what will be needed is some partitioning and segregation at the sites so that a scope can be reasonably defined.

  3. Scope has to come first, then risks can be assessed for a given scope. That said, defining scope is complex and understanding risks can help enormously in incentivizing all parties to reduce and enforce the smallest feasible scope.

  4. You can use the SAQ for a gap analysis as soon as you have a scope.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .