Does giving access to third party to access the environment where the card holder data are passed against PCI DSS requirement?
The third party will have access only to a particular directory where NO customer data hits or exists.
-
it expands your scope to the 3rd party ...– schroeder ♦Aug 23, 2017 at 12:40
-
@schroeder, Would you please give more details.– PetrAug 23, 2017 at 13:03
-
blog.securitymetrics.com/2015/04/…– schroeder ♦Aug 23, 2017 at 13:09
Add a comment
|
1 Answer
PCI DSS Scope
For PCI compliance you need meet the security requirements for all the Application/DataStorage/Networking that manage the cardholder information or that it's connected to the environment where the cardholder data is stored/managed or proccessed.
-
Do they need to be PCI DSS compliant as well in order to allow them to connect ?– PetrAug 24, 2017 at 5:43
-
1@Petr they can be, but still falls under you to prove it. All the work you do to fullfill the requerements inside your bussiness should be replicated for the third party assets accessing your card holder environment.– TridamAug 24, 2017 at 14:02