7

I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks sometimes include a POS device. We never receive, process, or even see any credit card information. However, since our customer is PCI compliant they want us to be PCI compliant as well.

1) Does PCI compliance require that all of your vendors (i.e me) to also be PCI compliant?

2) All the info and questionnaires I've found are specifically aimed at organizations that actually store or process payment data. Is there a self assessment for situations where I don't transmit any credit card data, but just sit on the same network as POS?

3) If, as this question suggests, I am already PCI Compliant, can I get something that certifies that I don't process any credit card data and am PCI compliant? Note that I don't think I am PCI compliant just because I don't store PAN. The customer would be in trouble if I exposed a security hole into their network (which I don't, but have no piece of 'certification' saying so).

Improve this question
4
  • Can you explain more about what your device does? Is it a switch or other device which network traffic transits? If all it's doing is sitting on the same network but not storing, processing, or transmitting card data, then at most your device needs to be scanned regularly and any issues resolved appropriately (which does not mean you need PCI compliance, it means your customers need to perform standard diligence in configuring and maintaining it). But, again, better if we knew what your device is.
    – gowenfawr
    Sep 16, 2014 at 14:38
  • It is a sensor that provides environmental information about a store. It connects to the customer's network and provides that environmental information back to us. We're able to connect to the device, which is essentially just a small linux computer on their network (think Raspberry Pi). You can think of the device like Nest or Dropcam for a commercial customer.
    – Scott
    Sep 16, 2014 at 14:41
  • You may find the PCI Quick Guide useful. From what I read sounds like you are in the clear and it's the customer's responsibility to firewall their network, but I am not certain.
    – Travis Pessetto
    Sep 16, 2014 at 15:02
  • This question is asking for a 'certificate' of sort. I am in a similar situation and looking to get 'certified' that we don't handle cc info to give peace of mind to customers. Any luck finding something along these lines?
    – Micah
    May 1, 2015 at 1:38

3 Answers 3

Reset to default
7

As your system is within the same network as the client systems which may handle cardholder data, your system can be included within the scope of the customer's compliance. In this regard you can be considered a connected system. From the scoping page of the PCI DSS: The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment.

It sounds like your system component is within or connected to the cardholder data environment (i.e. the environment within which the POS or other device handling cardholder data is situated).

It sounds like the client should either segment your device at a network level to remove it from the cardholder data environment or include your device with their scope of their compliance. To do this, you should provide the client instructions on how to situate and maintain your device in a secure manner.

As you can log on remotely to your device, you could attack the customer's network internally. Is the Linux device hardened, is it kept up to date, is logging enabled, what user management is in place, is IP tables configured? Does remote access require two-factor authentication? Each of these are questions which a QSA will pose in regards to the security of, and potential threat/vulnerability posed by the device.

Improve this answer
2

If you never see, process or store PCI information, then you do not need to be in your customer's PCI DSS scope.

You may find the QSA wants to ask some questions just to confirm this status, but scope should only include card information.

Improve this answer
0

Do you store Credit Card data ? Does it ever pass through your system ?

If you answered No then you are compliant. PCI only applies to those companies that handle credit card data. I believe there is a self-assessment that you can perform that requires little work.

https://www.pcisecuritystandards.org/merchants/self_assessment_form.php

hope that helps

Improve this answer
1
  • I see the Self Assessment Questionaire (SAQ) here under the 'SAQs' tab. However there are 15 different ones. Which one do I need for my case?
    – Scott
    Sep 16, 2014 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .