The PCI DSS v3 standard states the following:
To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that even if the out-of-scope system component was compromised it could not impact the security of the CDE.
Say we have a cloud based system that we want to be PCI compliant, and the source code for this system is in another cloud based system like Bitbucket. Can an Octopus Deploy server that is connected to or inside the CDE connect to our source control repository via HTTPS and then deploy, or would this bring Bitbucket into scope, as a compromised repository could affect the security of the CDE? What would be a compliant way to do this automatically?