We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and technology and we have ensured none of our business processes need full PAN in any of our systems or processes and therefore there is no CDE.
Do we STILL need to have secured firewalls, development methods, manage access etc if we do not have a CDE ourselves.
Understand that these are required from a best practice and from a security perspective. Would be great to know from a PCI perspective? Question arises from the fact that even if someone is into our firewalls/network, there is no chance that they will get any clear text pan