Most of the questions I see on Information Security seem to be about technical security issues. Are questions about security standards compliance in scope?
Our company is creating an ecommerce website that is hosted entirely offsite. Access to the remote servers will be restricted, with only a couple of admins accessing it (probably via a VPN).
All credit card information is transmitted to and stored on the remote web server. In this situation how must we scope our PCI-DSS assessment (SAQ-D)? Should it
- Only include our hosting service, the VPN, and the devices and admins that connect to the VPN. OR
- Include our entire office LAN, even though it has no direct connection to the systems handling the credit card data.