One Last Time On Disaster Recovery

I have written three posts on this topic, yet it still comes up.

• Disaster Recovery Sites and PCI
• Disaster Recovery and PCI
• Business Continuity and PCI

Here are the Cliff Notes from those posts.

Hot sites are always in scope for PCI compliance because they can support failover on demand.

Cold sites are never in scope for PCI compliance because there is nothing there that would be in scope.

Warm sites are only in scope if they have cardholder data (CHD) processed, stored or transmitted from that site.

There are nuances with all of this, so if you want more information, read the three posts.

Advertisement