Backup server categorization in the Open PCI Scoping Toolkit

Question

How are backup servers which host a copy of cardholder data supposed to be categorized according to the Open PCI Scoping Toolkit, given that the backup and storage guidelines from the PCI standards are already being met?

If I take the categorizes listed at face value backup servers need to be treated as category 1a. The repercussion would be that I couldn't backup my isolated class 3 servers from this backup server. If these files can be treated as files only and not as cardholder data proper the flow diagram makes more sense. Backup servers would be capable of being treated as a 2b device and capable of backing up category 1 and 3 boxes.

The second option sounds like more of what is intended in the reqs themselves since there is no mention of segregation in the primary requirements document, just that the backups be secured encrypted etc. It seems counter-intuitive that we'd need an independent backup system and tape library just for this so I'd love someones insight that has been doing this longer than I.

Answer 1

I can't comment, but can you elaborate on the categorizations? I don't wish to subscribe to the linked toolkit. If you meet the backup and storage guidelines you need to consider the backed up data in the same context as the original data. Who can access it from the backup server and storage. Is the backup encrypted? Are ACLs maintained? Is there a large pool of backup admins that can access the backup data that were not privy to the same data in the original location? It sounds like your question is asking about backup targets. If you back up PCI and non-PCI data to a common target that target must meet all PCI requirements. You should be able to use the same backup infrastructure, but partition out your media pools or targets. You might need to set different policies with different sets of admins and jobs. You might then be able to share your infrastructure.

Answer 2

I've done a great deal of research on this subject. It is apparently possible to treat encrypted data as out of scope if and only if it has been validated that the entity that possesses encrypted cardholder data does not have the means to decrypt it. 3.2, page 8.

Unfortunately in my case there isn't a way to readily guarantee that someone with access to the backup server can't grab a backup of drives that contain the encryption keys.