PCI-DSS scoping when there is no CDE

Question

We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and technology and we have ensured none of our business processes need full PAN in any of our systems or processes and therefore there is no CDE.

Do we STILL need to have secured firewalls, development methods, manage access etc if we do not have a CDE ourselves.

Understand that these are required from a best practice and from a security perspective. Would be great to know from a PCI perspective? Question arises from the fact that even if someone is into our firewalls/network, there is no chance that they will get any clear text pan

Answer 1

From a PCI perspective, you're responsible for verifying that the third parties to whom you have outsourced various responsibilities are compliant for the services they are performing on your behalf. To achieve this, you should enumerate those service providers and responsibilities of each and review their Attestations of Compliance, perform due diligence on engaging and annually.

Given your volume, you can self-assess as a merchant - you'd likely require completion of Self-Assessment Questionnaire A wherein you would respond to requirement 12.8 in relation to the above processes.

Answer 2

PCI-DSS is only applicable to the entities or the organizations which have CDE in their control. However, there could be contractual requirements that state if the vendor has an integration with the CDE, although no CHD or Sensitive Data is getting transferred, compliance with PCI-DSS is required. In this case, the CDE and non-CDE should be segmented using Firewall. You can refer to section 2 Understanding Scoping and Segmentation for PCI DSS.