3

Our company does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant.

We just require to access the cloud portal from our company. I understand we need to be PCI compliant as well.

Are we required to have a DRP (Disaster Recovery Plan) in place for our AD servers/WSUS and Desktops, etc?

We just use our infrastructure to login to cloud solutions. We don't store any card data.

  • Disaster Recovery Plan? Or do you mean DLP, Data Loss Prevention? – gowenfawr Mar 11 '15 at 10:51
  • I mean Disaster recovery plan, As part of Incident management process, we need to mention about DRP. – PCIrs Mar 11 '15 at 11:20
  • But my doubt is, as we dont store any card numbers in our premises, we dont require to have DRP as we just connect through internet for accessing the real cloud based solution which is already PCI compliant – PCIrs Mar 11 '15 at 11:22
  • @PCIrs you still transmit card data from and to the cloud solution when you access it no? You can see card numbers in the application? – Lucas Kauffman Mar 11 '15 at 11:24
  • Yes we can see card numbers from application, but we dont store anything in our environment. – PCIrs Mar 11 '15 at 11:32
1

You are required to have a backup plan, you don't need a DRP plan. The only required DRP plan is in regard to an incident. So a DRP related to incident response (e.g. breach).

However if you are doing DRP, then your DRP plan should make sure your DRP site is PCI compliant.

  • Ok, as a backup plan, company is ready to accept the downtime instead of spending more for infrastructure. Is that OK? – PCIrs Mar 11 '15 at 11:34
  • You are required to backup and retain certain logs in a secure way. – Lucas Kauffman Mar 11 '15 at 11:49
  • Yes, We will certainly backup the logs and keep it for 1 year in a encrypted storage. – PCIrs Mar 11 '15 at 11:52
  • Just to confirm, We dont require the Disaster Recovery site right right?. Thanks for your help – PCIrs Mar 11 '15 at 11:53
  • 1
    You need a disaster recovery plan in regard to incident response, you don't need a site. What you do with your business is your problem, the thing PCI wants to maintain is secure storage of your PCI data. – Lucas Kauffman Mar 11 '15 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.