Does giving access to third party to access the environment where the card holder data are passed against PCI DSS requirement?

The third party will have access only to a particular directory where NO customer data hits or exists.


1 Answer 1



For PCI compliance you need meet the security requirements for all the Application/DataStorage/Networking that manage the cardholder information or that it's connected to the environment where the cardholder data is stored/managed or proccessed.

  • Do they need to be PCI DSS compliant as well in order to allow them to connect ?
    – Petr
    Commented Aug 24, 2017 at 5:43
  • 1
    @Petr they can be, but still falls under you to prove it. All the work you do to fullfill the requerements inside your bussiness should be replicated for the third party assets accessing your card holder environment.
    – Tridam
    Commented Aug 24, 2017 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .