Even though the web site never sees the cardholder data or sensitive authentication data in the clear, and never has access to the encryption keys, I would think the web site is in-scope because it could affect the security of the data. If the web site is hacked and changes the redirect to go to a hacker site, data can then be stolen.

In the case I am working now, the web site is owned by a service provider that a merchant is working with. The service provider is not the 3rd party that deals with the card data. If I am correct it leads to a slightly weird situation where there is no CDE (cardholder data environment) at the service provider and they only have this one web server that is in-scope. Although there is a question of whether other servers on the same network "segment" as the web server should get pulled in-scope too, but that is a different issue.


Yes. You are still in scope, although a lower level of compliance may apply to you. Read the following:

Q2: To whom does the PCI DSS apply?

A: The PCI DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data.

Source: To Whom does PCI DSS apply?

You may qualify for one of the less restrictive levels of PCI-DSS. To find out, check this link: Which SAQ is appropriate for me?

Here is a good reference to get you started on your own compliance: ComplianceGuide.org.

  • In the specific case I am looking at, a full ROC is required for the service provider. If a ROC were not required SAQ-A would fit the bill. There is an FAQ that indicates that when a ROC is needed, if a particular SAQ would have otherwise fit, that SAQ can guide which requirements in the ROC are relevant or not-applicable. However SAQ-A is only for merchants, so doesn't seem to help me.
    – knokej
    May 16 '19 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.