Virtual Machine (VM)

PCIComplianceHubLast updated

A software-based emulation of a physical computer system that runs on a host system. VMs can be used to isolate sensitive environments, such as those containing cardholder data, from other systems, helping to maintain PCI DSS compliance.

Applies to. PCI DSS v4.0.1 does not treat a VM differently from a physical server. The scope review asks for all system components in the CDE, connected to the CDE, or able to affect its security, and a VM meets that test on what it does, not on how it is hosted. Where isolation is used to separate systems of differing security levels on shared hosts, segmentation penetration testing must confirm that the isolation is effective.
Limits. Bringing a VM into scope brings its host with it. As a matter of general practice the hypervisor and host beneath an in-scope VM can affect its security and so fall inside the same scope test.
Related. Virtualization, Hypervisor, System Component, Cloud Computing, Network Segmentation
Sources. PCI DSS v4.0.1 (June 2024)