We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and technology and we have ensured none of our business processes need full PAN in any of our systems or processes and therefore there is no CDE.

Do we STILL need to have secured firewalls, development methods, manage access etc if we do not have a CDE ourselves.

Understand that these are required from a best practice and from a security perspective. Would be great to know from a PCI perspective? Question arises from the fact that even if someone is into our firewalls/network, there is no chance that they will get any clear text pan


From a PCI perspective, you're responsible for verifying that the third parties to whom you have outsourced various responsibilities are compliant for the services they are performing on your behalf. To achieve this, you should enumerate those service providers and responsibilities of each and review their Attestations of Compliance, perform due diligence on engaging and annually.

Given your volume, you can self-assess as a merchant - you'd likely require completion of Self-Assessment Questionnaire A wherein you would respond to requirement 12.8 in relation to the above processes.

  • Thanks @Andymac. We have verified all the TSP and they have provided their attestation of compliance(AOCs). Given we have that and we have an yearly programme to monitor their compliance, should we worry about auditing, logging, managing our firewalls etc (Since, we do not have a CDE and even if there is a network breach there will not be any loss of card information) – Kane Jan 24 at 7:42
  • Depending on your risk profile, you can consider whether to implement such controls for best practice purposes. For PCI compliance, it sounds like you don't have an in-scope environment so none of those controls would be applicable. – AndyMac Jan 24 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.