Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Can some one help me to confirm that End of Life hardware complies with PCI DSS 3.2 or not?
I only see requirements for software but no mention of hardware? Any guidance would be greatly appreciated.
6.2: Protect all system components and software from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.
I worked for a PCI ASV for five years. This isn't compliant - you can't ensure that you're patched against security vulnerabilities if there are no security patches to apply.
However, your PCI ASV may, at their own discretion, choose not to fail you for it. I have seen clients in situations where changing the software would cost multiple millions, or where there's literally no other option. The way this is usually resolved is that they apply secondary security controls to mitigate the risk, for example isolating a Windows application inside a well-configured Citrix XenApp instance on a terminal services server, with AV installed (and up to date!) and OS lockdown in place. Or, for a web application, installing a WAF and making custom WAF rules to prevent exploitation of known vulnerabilities (e.g. XSS) as and when they come to light. In all cases this involves an in-depth security assessment of the EoL'd product in order to ascertain its security posture and risk. In most cases it also involves providing your ASV with a long-term plan to replace or move away from the EoL'd product.
Your ASV absolutely must mark non-compliant components of your network or system as non-compliant, but they may also mark it as an exception (with justification) and give you an overall pass on the assessment.
