We currently process, but do not store, credit card data. We authorize the cards via a self developed application using the authorize.net API.

If possible, we would like to limit all requirements of PCI that effect our *servers* (such as installing Anti-Virus) to an isolated separate environment. Is that possible to do while still maintaining compliance?

If so, what would constitute sufficent isolation? If not, is there somewhere where that scope is clearly defined?