2

We have an internal system and I am trying to determine if the system is in scope for the purposes of PCI-DSS compliance.

The system is completely internal, no public access. The system hold user information that includes an account number. It is possible that this account number might be an PAN from a credit card, although we don't really know whether it is or it isn't. The system does not process or take payments.

Is this enough to make that system in scope for PCI?

Improve this question
1
  • 1
    Sounds like you don't even know whats on the system if you don't know what the account number is. How can a system contain information and what information is stored is not known? Sounds like you should encrypt al information on the system because of a single fact you don't know what the information is.
    – Ramhound
    Aug 29, 2013 at 12:32

3 Answers 3

Reset to default
3

Does your system store, transmit, process card holder data along with PAN number?

If you answer yes to at least one statement then your system is in scope and will need to be PCI compliant.

It is possible that this account number might be an PAN from a credit card

It doesn't seem to be clear to you what this account number is, but if it helps you understand the compliance scope:

  • if every account number is a full PAN, then the system is in scope.
  • if 1/100 account number is a full PAN, then the system is in scope.
  • if 1/1000 account number is a full PAN, then the system is in scope.

  • if 1/n account number is a full PAN, then your system is in scope.

  • if no account number is a full PAN, then your system is out of scope

  • if the PAN contains only a subset of the full card number, such as the last four or the first six and the last four the your system is out of scope.

Please keep in mind the statements above apply to your account numbers (might be a PAN) being stored, transmitted or process by your system.

Even if you do not process or take payment and you do store PAN for any purpose (account number) your system will be in scope.

Improve this answer
0

Quoting from the PCI-DSS Requirements and Security Assessment Procedures version 2.0 (page 5):

PCI DSS applies to all entities involved in payment card processing – including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.

On the other hand, you seem to have an account number that may or may not be a credit card PAN and your system doesn't process payments. Considering this, I'd say you don't have to be PCI compliant.

Improve this answer
-1

Think about it this way:

  1. Will the confidentiality of the user data be compromised if the system is breached?
  2. Even though the system is inaccessible from outside, are there other internal threats like unauthorised access and software vulnerabilities?
  3. Is it part of the system that needs to be PCI-DSS compliant?

If your answer is yes for any of the above, it is part of the scope.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .