Frequently Asked Question
Are disaster-recovery (DR) sites in scope for PCI DSS?
Alternatively, “cold standby” approaches, where the DR site does not contain any CDE systems or cardholder data and does not connect to the CDE, may be excluded from scope while the DR site is not in use. However, in the event that the DR site is activated, the entity must ensure that the DR site is configured to maintain all applicable PCI DSS requirements for the duration that it is used, and that all cardholder data is securely deleted from the DR site upon completion of its use.
Any testing activity performed on a DR site (for example, to simulate activation of the site) that includes the presence of cardholder data or other component that impacts the security of cardholder data, are also in scope for PCI DSS requirements.