Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a database for its configuration information.
Please note that the database only contains configuration information. No card holder or personal details are stored here. However, we also have a management portal that is accessed by clients. The clients can log in to the management portal, and change their configuration that is saved to the shared database.
So we have:
Application --> Shared DB <-- Management Portal <-- Client access
Is it possible for the Shared DB
and the Management Portal
to be out of scope if on a separate network, making the CDE the Application
only?
From the PCI v3 standard:
At a high level, adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not.
Does the above appear to adhere to this recommendation?