Most of the questions I see on Information Security seem to be about technical security issues. Are questions about security standards compliance in scope?

For example:

Our company is creating an ecommerce website that is hosted entirely offsite. Access to the remote servers will be restricted, with only a couple of admins accessing it (probably via a VPN).

All credit card information is transmitted to and stored on the remote web server. In this situation how must we scope our PCI-DSS assessment (SAQ-D)? Should it

  1. Only include our hosting service, the VPN, and the devices and admins that connect to the VPN. OR
  2. Include our entire office LAN, even though it has no direct connection to the systems handling the credit card data.
  • 1
    While this q is definitely ontopic as @Rory said, you need to take any answer with a grain of disclaimer salt, that we are not your QSA. You would really need to get your QSA to sign off on it, whatever you do...
    – AviD Mod
    Mar 20 '15 at 8:17

If you have a look at the site you will see we have lots of PCI questions, in fact there is a whole tag for that topic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .