1

I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:-

Are penetration-testing procedures defined to test all segmentation methods, to confirm they are operational and effective, and isolate all out-of-scope systems from systems in the CDE?

We are a small business with a single card machine that takes payment by phone.

So the CDE is essentially the entire company as the card machine connects to the internet through the broadband router. We do have a DMZ with a single machine running on it for email access, but it has no ports open between the DMZ and internal network. In addition when we perform a network scan, I include the external IP's of the machine in the DMZ in addition to the IP's of the LAN.

Do I still need to pen-test our LAN from the DMZ as it seems to me, it's all already in scope of PCI DSS?

Improve this question
3
  • You should talk to your payment processor about details. Did you do the self-assessment, what type of merchant did you select? Hopefully you use secure end-to-end encrypted PIN solutions?
    – eckes
    Mar 6, 2018 at 12:25
  • Something to consider is your single card machine. As you describe your environment you are probably looking at an SAQ B-IP. Have you considered getting an analog phone line and an analog card machine? This would move you to an SAQ B which has a smaller scope.
    – waltonob
    Mar 6, 2018 at 22:10
  • Thanks for the replies. I think we'll probably be looking at getting rid of said card machine and moving to either an analog type, or to a payment portal which moves responsibility for SAQ B-IP to the host provider. Obviously we still need to comply with our PCI DSS requirement but I believe that would put us in SAQ A (hosted) which has a much lower level of entry or SAQ B as @waltonob suggested. The card machine was brought in to the business before my time, and it's been a hassle since I started.
    – li_greeny
    Mar 7, 2018 at 10:03

1 Answer 1

Reset to default
1

§11.3.4 is specifically aimed at organizations that are using segmentation to limit their PCI scope. When you say:

So the CDE is essentially the entire company as the card machine connects to the internet through the broadband router.

It sounds like you're not in this category. If the card machine is on the same flat network as all your other internal company machines, then yes, they're all in scope. If that is the case, then §11.3.4 doesn't apply to you - here's the full text with emphasis on the parts that distinguish from what you're doing:

11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to segmentation controls/methods to verify that the segmentation methods are operational and effective, and isolate all out-of-scope systems from systems in the CDE.

You're not using segmentation to isolate, so you don't need to verify you're doing so effectively. You don't have out-of-scope systems isolated from the CDE.

So you still need to have a pen test of everything per §11.3.2 - it just doesn't need to verify your (non-existent) segmentation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .