I have a networked product that we install on customer networks. The device is d
ID: 659361 • Letter: I
Question
I have a networked product that we install on customer networks. The device is does not pass any of the CC data, but only sits on the same network (think Nest or Dropcam). The customer networks sometimes include a POS device. We never receive, process, or even see any credit card information. However, since our customer is PCI compliant they want us to be PCI compliant as well.
1) Does PCI compliance require that all of your vendors (i.e me) to also be PCI compliant?
2) All the info and questionnaires I've found are specifically aimed at organizations that actually store or process payment data. Is there a self assessment for situations where I don't transmit any credit card data, but just sit on the same network as POS?
3) If, as this question suggests, I am already PCI Compliant, can I get something that certifies that I don't process any credit card data and am PCI compliant? Note that I don't think I am PCI compliant just because I don't store PAN. The customer would be in trouble if I exposed a security hole into their network (which I don't, but have no piece of 'certification' saying so).
Explanation / Answer
As your system is within the same network as the client systems which may handle cardholder data, your system can be included within the scope of the customer's compliance. In this regard you can be considered a connected system. From the scoping page of the PCI DSS: The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment.
It sounds like your system component is within or connected to the cardholder data environment (i.e. the environment within which the POS or other device handling cardholder data is situated).
It sounds like the client should either segment your device at a network level to remove it from the cardholder data environment or include your device with their scope of their compliance. To do this, you should provide the client instructions on how to situate and maintain your device in a secure manner.
As you can log on remotely to your device, you could attack the customer's network internally. Is the Linux device hardened, is it kept up to date, is logging enabled, what user management is in place, is IP tables configured? Does remote access require two-factor authentication? Each of these are questions which a QSA will pose in regards to the security of, and potential threat/vulnerability posed by the device.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.