3

Our company is does not store any credit card details but we do transmit them. We are storing it in a cloud platform which is already PCI compliant.

We just require to access the Cloud portal from our company. I understand we need to be PCI compliant as well.

But regarding the backup, we need to backup the log management. My question is, do we still require to store the backup offsite? Or is it ok if we store it locally?

  • 1) Are you sure that you need to be PCI compliant? 2) Always store backups on encrypted media and store offsite. 3) Regularly test that you can recover data from the backup media. – schroeder Mar 11 '15 at 5:20
  • Yes i am sure we need to be PCI compliant as we transmit card data as we use our desktops to connect to cloud solution. – PCIrs Mar 11 '15 at 6:24
  • 1
    Do you have access to full PANs (more than the first 6 and last 4 digits of the card number) when logged into your cloud solution? – JekwA Jul 15 '15 at 17:40
1

Page 10 of the PCI DSS v3.1 states:

"The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment. The cardholder data environment (CDE) is comprised of people, processes and technologies that store, process, or transmit cardholder data or sensitive authentication data."

So your systems are indeed in scope for PCI because they transmit cardholder data.

Since all the cardholder data is stored by your cloud provider you don't have to worry about any storage requirements for the cardholder data (encryption and key management).

You DO however have to worry about your logging. Since your machines are used to connect to the CDE they're brought in scope. Logs of all in scope systems COULD be stored locally on each end point, but enforcing the rest of the requirements for logs becomes very hard if they're not centrally managed.

Requirement 10.5:

Secure audit trails so they cannot be altered.

Requirement 10.7:

Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from backup).

You don't have to store log backups off site and depending on your companies risk assessment it might not be cost effective to do so, but I would highly recommend storing them on a centrally managed system that is access controlled.

Edit - added clarification about 9.5.1 so people don't have to sift through comments (Thanks @SilverlightFox)

The heading for requirement 9 states

“Media” refers to all paper and electronic media containing cardholder data.

Since there isn't any cardholder data being backed up or even stored in the first place requirement 9.5.1 would be N/A because the "media" doesn't contain cardholder data.

  • What about 9.5.1 "Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. Review the location’s security at least annually." – schroeder Jul 15 '15 at 22:42
  • Yes, "preferably" as in not required. In the end it's up to the auditor to decide but as long as they're secure they should be fine. – JekwA Jul 15 '15 at 22:44
  • Yep, but it's worth a mention somewhere. – schroeder Jul 15 '15 at 22:45
  • @schroeder: Requirement 9 only applies to cardholder data, not logs. – SilverlightFox Jul 16 '15 at 10:17
  • 1
    @schroeder/JekwA: Yes, they are in scope but I disagree that they are subject to 9.5.1 because that only applies to Cardholder data itself. 10.5.3/4 applies here though: Promptly back up audit trail files to a centralized log server or media that is difficult to alter. & Write logs for external-facing technologies onto a secure, centralized, internal log server or media device.. – SilverlightFox Jul 18 '15 at 15:37
-1

What I understand from your question is that, you are talking about backup of Logs. PCI requires that all logs should be stored in Central log server ( Refer to Requirement 10). There is no where mentioned your logs should be backedup in other media and store it offsite. Since you are not storing any card data locally, other card data storage on media is not applicable for you.

  • What about 9.5.1 "Store media backups in a secure location, preferably an off-site facility, such as an alternate or backup site, or a commercial storage facility. Review the location’s security at least annually." – schroeder Jul 15 '15 at 17:29
  • @schroeder: Upvote because requirement 9 should be out of scope for the OP due to the cloud provider taking responsibility for physical data. – SilverlightFox Jul 16 '15 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.