PCI DSS Compliance when extracting data for analysis

Question

Here's the scenario: I've got 2 subnets. 1 is PCI DSS Compliant and the other one is not. Can I extract data to process on Kafka from the PCI compliant subnet into the non-compliant one?

tl;dr Data that has to be analysed is on the compliant subnet. Kafka is located on the non-compliant subnet.

Answer 1

PCI DSS doesn't really care what technologies you're using, so the fact that Kafka is involved makes no difference. All that matters is whether the data you are processing includes payment details which would make PCI DSS apply.

If it does, anything that processes that data must be PCI DSS compliant. If you can 100% guarantee that it doesn't, then PCI DSS doesn't apply.

Logically, if the first was not the case, all protections would be meaningless, because an attacker could ignore the protected servers and get the same data from the unprotected ones; if the second was not the case, you would never be able to know if a payment had been made, because the secured servers wouldn't be able to send you that data.

Answer 2

If you are accessing your PCI DSS Compliant subnetwork ( cde-subnet ) from your non compliant subnetwork ( non-cde-subnet ) then the non-cde-subnet is considered Connected to and/or Security Impacting System because it meets below criteria:

System component is on a different network (or
subnet or VLAN), but can connect to or access the
CDE (e.g., via internal network connectivity).

Following the PCI documentation:

The following scoping concepts always apply:
 - Systems located within the CDE are in scope, irrespective of their functionality or the reason why they
are in the CDE.
 - Similarly, systems that connect to a system in the CDE are in scope, irrespective of their functionality or
the reason they have connectivity to the CDE.
 - In a flat network, all systems are in scope if any single system stores, processes, or transmits account data

Docs: https://www.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1.pdf

You can either move Kafka to pci compliant subnet or you need to make some changes to your currently non compliant subnet.