<div>
This seems clear to me. &nbsp;Just to validate question 2, that even though these are internal web servers, the database server needs to be separated from the web server.
</div>


<div>
FYI, the reports would probably not have PCI data. &nbsp;It is just high level reports about the data.
</div>


<div>
<div class="content wysiwyg-content">
I am fighting this same question from 2 sides. &nbsp;Clearly PCI states that the presentation web server (HTTP and HTTPS) should be separated from the database through a firewall. &nbsp;Here are the scenarios though and why they want an exception.<br />
<br />
1. Some internal people (not in a PCI environment, but work for the organization) want reports. &nbsp;They currently VPN from the non-PCI environment to the PCI environment to get the PCI related reports. &nbsp;It is the only way to access them. &nbsp;It seems to me that these should be separated. &nbsp;Will auditors scream at this?<br />
<br />
2. The same set of servers are accessed by multiple systems. &nbsp;The web servers and the data again reside on the same box. &nbsp;Is this an issue?
</div>
</div>


I am fighting this same question from 2 sides.  Clearly PCI states that the presentation web server (HTTP and HTTPS) should be separated from the database through a firewall.  Here are the scenarios though and why they want an exception.

1. Some internal people (not in a PCI environment, but work for the organization) want reports.  They currently VPN from the non-PCI environment to the PCI environment to get the PCI related reports.  It is the only way to access them.  It seems to me that these should be separated.  Will auditors scream at this?

2. The same set of servers are accessed by multiple systems.  The web servers and the data again reside on the same box.  Is this an issue?

This seems clear to me.  Just to validate question 2, that even though these are internal web servers, the database server needs to be separated from the web server.

FYI, the reports would probably not have PCI data.  It is just high level reports about the data.

PCI Internal Web Servers

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.