Our company does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant.

We just require to access the cloud portal from our company. I understand we need to be PCI compliant as well.

Are we required to have a DRP (Disaster Recovery Plan) in place for our AD servers/WSUS and Desktops, etc?

We just use our infrastructure to login to cloud solutions. We don't store any card data.

  • Disaster Recovery Plan? Or do you mean DLP, Data Loss Prevention?
    – gowenfawr
    Commented Mar 11, 2015 at 10:51
  • I mean Disaster recovery plan, As part of Incident management process, we need to mention about DRP.
    – PCIrs
    Commented Mar 11, 2015 at 11:20
  • But my doubt is, as we dont store any card numbers in our premises, we dont require to have DRP as we just connect through internet for accessing the real cloud based solution which is already PCI compliant
    – PCIrs
    Commented Mar 11, 2015 at 11:22
  • @PCIrs you still transmit card data from and to the cloud solution when you access it no? You can see card numbers in the application? Commented Mar 11, 2015 at 11:24
  • Yes we can see card numbers from application, but we dont store anything in our environment.
    – PCIrs
    Commented Mar 11, 2015 at 11:32

1 Answer 1


You are required to have a backup plan, you don't need a DRP plan. The only required DRP plan is in regard to an incident. So a DRP related to incident response (e.g. breach).

However if you are doing DRP, then your DRP plan should make sure your DRP site is PCI compliant.

  • Ok, as a backup plan, company is ready to accept the downtime instead of spending more for infrastructure. Is that OK?
    – PCIrs
    Commented Mar 11, 2015 at 11:34
  • You are required to backup and retain certain logs in a secure way. Commented Mar 11, 2015 at 11:49
  • Yes, We will certainly backup the logs and keep it for 1 year in a encrypted storage.
    – PCIrs
    Commented Mar 11, 2015 at 11:52
  • Just to confirm, We dont require the Disaster Recovery site right right?. Thanks for your help
    – PCIrs
    Commented Mar 11, 2015 at 11:53
  • 1
    You need a disaster recovery plan in regard to incident response, you don't need a site. What you do with your business is your problem, the thing PCI wants to maintain is secure storage of your PCI data. Commented Mar 11, 2015 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .