PCI SSCPCI DSSScoping SegmentationEASYFree question
When is a system considered out of PCI DSS scope?
- A.When it is properly segmented from the CDE and has no connectivity that could affect CDE security
- B.When it holds no PANs and the entity has documented its business purpose in the system component inventory
- C.When it is owned by a third party and the contract makes the vendor responsible for its security patches
- D.When it has no public IP address and sits behind the corporate firewall
Why A is correct
Systems are out of scope only when they are properly segmented from the CDE with no network connectivity or other means that could impact CDE security.
Know someone studying for PCI DSS? Send them this one.