Patch Mgmt - Vulnerability Scans for Workstations

[SimplePCI]

Will PCI Auditors look at all the Level 3,4,5 vulnerabilities which may show up on workstations connected to a large distributed global Company network?

[SimplePCI]

Will PCI Auditors look at all the Level 3,4,5 vulnerabilities which may show up on workstations connected to a large distributed global Company network?
More importantly, since most servers internally are IP-accessible to all workstations, are the vulnerabilities of these workstations in scope?

[jbhall56]

Any workstations that have access to PCI servers are in scope whether they truly access the PCI servers or not.

This is why the PCI DSS recommends that PCI servers be firewalled away from non-PCI assets. If the PCI servers are firewalled away from the general network with appropriate rules, then controlling and monitoring of traffic and protection of these servers can be accomplished.