We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3rd party providers. Understand that PCI is about people, process and technology and we have ensured none of our business processes need full PAN in any of our systems or processes and therefore there is no CDE.

Do we STILL need to have secured firewalls, development methods, manage access etc if we do not have a CDE ourselves.

Understand that these are required from a best practice and from a security perspective. Would be great to know from a PCI perspective? Question arises from the fact that even if someone is into our firewalls/network, there is no chance that they will get any clear text pan


From a PCI perspective, you're responsible for verifying that the third parties to whom you have outsourced various responsibilities are compliant for the services they are performing on your behalf. To achieve this, you should enumerate those service providers and responsibilities of each and review their Attestations of Compliance, perform due diligence on engaging and annually.

Given your volume, you can self-assess as a merchant - you'd likely require completion of Self-Assessment Questionnaire A wherein you would respond to requirement 12.8 in relation to the above processes.

  • Thanks @Andymac. We have verified all the TSP and they have provided their attestation of compliance(AOCs). Given we have that and we have an yearly programme to monitor their compliance, should we worry about auditing, logging, managing our firewalls etc (Since, we do not have a CDE and even if there is a network breach there will not be any loss of card information) – Kane Jan 24 '19 at 7:42
  • Depending on your risk profile, you can consider whether to implement such controls for best practice purposes. For PCI compliance, it sounds like you don't have an in-scope environment so none of those controls would be applicable. – AndyMac Jan 24 '19 at 16:25

PCI-DSS is only applicable to the entities or the organizations which have CDE in their control. However, there could be contractual requirements that state if the vendor has an integration with the CDE, although no CHD or Sensitive Data is getting transferred, compliance with PCI-DSS is required. In this case, the CDE and non-CDE should be segmented using Firewall. You can refer to section 2 Understanding Scoping and Segmentation for PCI DSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.