I am trying to further understand the scope of my environment.

I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device.

I understand my group of 2x devices are required to comply with the controls 1.4, 2, 5 and 6.1

Does this group require the same physical security (Cameras, carded entry systems, etc)?


Disclaimer: IANAQSA

Question: Are group 2x devices required to comply to all PCI in-scope controls?

Short version: Not necessarily, but they could be... it's really up to the assessor. The use of categories is a way to make more persuasive arguments to your assessor when you want to determine if a device needs to comply to specific controls or not.

Long version:

The category classification system that you're using - the Open PCI DSS Scoping Toolkit - clearly states:

We believe the Toolkit to be consistent with the spirit and intent of the PCI DSS. 
However, the Toolkit is not endorsed by the PCI Security Standards Council in any way, 
nor is it the product of an official Special Interest Group. 

The PCI DSS itself has no concept of categories 1-3 or "infection"*. This paradigm got thrown out there by people who were sick of dealing with the incredibly ambiguous "connected" definition of scope the DSS actually uses. As far as the DSS is concerned, everything is either in- or out- of scope. And if it's in scope, "...PCI DSS security requirements apply..."

So in pure PCI DSS terms, if it's in scope, all requirements apply.

And if you look at the table in section 6.4 of the Open PCI DSS Scoping Toolkit, you'll see that 1a through 2x are all "in scope":

Summary of Categories, Open PCI DSS Scoping Toolkit

But wait! If you go on to read the "Frequently Asked Questions" in Appendix B of the Toolkit, it directly addresses your question (but might not answer it):

  • 10.6 The Toolkit repeatedly states that for Category 2x system components, such as administrative workstations, not all PCI DSS controls are applicable or necessary. How does one determine which controls are required?

The answer: if you look at the access a 2x device has, its limitations, and its compensating controls, then you can make reasonable arguments that certain DSS requirements don't need to be applied. And if you can convince your assessor that you've got a good case, then you're all set. (This is true of any category device, by the way, but you'll never convince your assessor that a 1a device should be exempt from DSS 3.4)

I encourage you to read through the Open PCI DSS Scoping Toolkit, especially 5.5, 5.7, 6, and 10 ("Appendix B"). The same message is repeated throughout:

  1. Use the Toolkit to fine-grain scope,
  2. Use fine-grained scope to reach reasonable agreements with your assessor.

For example:

  • 10.3 Why doesn’t the Toolkit specify which PCI DSS control requirements apply for each sub-category?

    The Toolkit states that all applicable PCI DSS controls are required for Category 1 and 2a system components and that no PCI DSS controls are required for Category 3 system components.

    However, because every organization and CDE is unique, it would impossible to provide more specific guidance on which PCI DSS controls are required for every type of Category 2b, 2c and 2x system component. The Toolkit does provide the basis for an organization and its assessor to discuss what the relevant risks are and the controls required to mitigate them.

* Personally, I believe that the choice of the word "infection" to describe scope transition among connected systems was a mistake; I don't know all the politics involved, but I'm reasonably confident that the PCI Security Standards Council will never put their stamp of approval on a document that makes PCI sound like a virus.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.