Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for approval code.
Does the PCI scope include the VX570 and the POS workstation? Note, no cardholder data stored in POS.
Technically, all systems on the same network as the POS workstation are in scope. Any system on a network segment where cardholder data is stored, transmitted, or processed is in scope, not just the systems that actually store, process, or transmit the data.
see page 10 of the following: https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf
The scope includes any system connected to the cardholder data environment. The cardholder data environment includes the network zones where cardholder data is stored, transmitted, or processed.
