0

Does giving access to third party to access the environment where the card holder data are passed against PCI DSS requirement?

The third party will have access only to a particular directory where NO customer data hits or exists.

1

PCI DSS Scope

For PCI compliance you need meet the security requirements for all the Application/DataStorage/Networking that manage the cardholder information or that it's connected to the environment where the cardholder data is stored/managed or proccessed.

  • Do they need to be PCI DSS compliant as well in order to allow them to connect ? – Petr Aug 24 '17 at 5:43
  • 1
    @Petr they can be, but still falls under you to prove it. All the work you do to fullfill the requerements inside your bussiness should be replicated for the third party assets accessing your card holder environment. – Tridam Aug 24 '17 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.