Assume a cardholder data environment (CHDE) is segregated appropriately, data in the environment is encrypted at rest and in transmission. We have a backup service that sits outside the CHDE. If we create an ACL to allow the backup service to run backups in the CHDE, this would potentially allow an admin to bypass multi factor authentication into the environment, by using the same ACL from the backup server/service. Am i right in thinking the only way to do this is to create a service inside the CHDE to run the backups, then push those files out of the CHDE to a remote storage???
When you create an ACL and allow your backup environment to access your CDE, it means your backup servers and the flow on the way to those servers are also in PCI scope. You can either create another big workload to yourself for auditing this new scope and creating MFA for this flow or you go with the option you think. I would go with a service inside the scope and make sure data is stored in a safe and different place from the other backups. (check PCI v3-2-1 requirement 9.5.1) Link: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf