Virtualization

Applies to. In PCI DSS the term is wider than virtual machines: containers, serverless functions and microservices are forms of virtualisation too. Wherever it is used, the hypervisor or orchestration layer and each virtual component it hosts are system components in their own right, and a hypervisor hosting a CDE guest is in scope even if its other guests are not. 2.2.3.c addresses the classic risk directly: where virtualisation technologies are used, functions with different security needs must not share a system component unless they are isolated from each other or all secured to the highest level among them.

Example. A merchant runs its payment application as containers on a shared cluster alongside its marketing website. The payment containers handle card numbers; the website does not. Under 2.2.3 the merchant either moves the payment workload to its own cluster, isolates it on dedicated nodes with network policy between the two, or secures the whole cluster to the level the payment function needs. Whichever it picks, the cluster's control plane is a system component in scope.

Limits. Virtualisation is not segmentation. Two virtual machines on one host share the host's memory, storage and management plane; a compromise of the hypervisor reaches both, so the hypervisor is in scope whenever any guest is. Putting a workload in a container or VM does not reduce its own requirements at all: the same Requirement 2 hardening, Requirement 6 patching and Requirement 10 logging apply as on a physical server. And the term is not the same as cloud computing: a cloud service uses virtualisation, but virtualisation also runs on a rack in the merchant's own back room.