Have a Point-of-sale (POS) workstation and a VX570 credit card terminal connected via RS232 and both on the same network with internet connection. No card data is transfered to the POS except for approval code.

Does the PCI scope include the VX570 and the POS workstation? Note, no cardholder data stored in POS.


Technically, all systems on the same network as the POS workstation are in scope. Any system on a network segment where cardholder data is stored, transmitted, or processed is in scope, not just the systems that actually store, process, or transmit the data.

see page 10 of the following: https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

The scope includes any system connected to the cardholder data environment. The cardholder data environment includes the network zones where cardholder data is stored, transmitted, or processed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.