Frequently Asked Question
Are disaster-recovery (DR) sites in scope for PCI DSS?
Alternatively, “cold standby” approaches, where the DR site does not contain any CDE systems or cardholder data and does not connect to the CDE, may be excluded from scope while the DR site is not in use. However, in the event that the DR site is activated, the entity must ensure that the DR site is configured to maintain all applicable PCI DSS requirements for the duration that it is used, and that all cardholder data is securely deleted from the DR site upon completion of its use.
Any testing activity performed on a DR site (for example, to simulate activation of the site) that includes the presence of cardholder data or other component that impacts the security of cardholder data, are also in scope for PCI DSS requirements.
Featured FAQ Articles
Most Recently Updated
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?