I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks.
At present, there's one PCI compliant network to which another network connects via VPN. The PCI compliant network will eventually store customer data and credit card information.
I read this article which suggests that as long as you don't store credit card numbers locally on the office network the scope doesn't extend that far. However, it's the VPN connection which leads me to think that it will indeed mean that the office would need to be PCI compliant too.
A large department all have access to the VPN (each with their own usernames) but with none of the password strength and renewal policies in place yet.
Is anyone able to clarify the situation preferably with reference to some official documentation?