PCI DSS Scoping

Correct scoping is 80% of PCI DSS. Get the data flows right first.

1. Find the Cardholder Data

Trace the full payment path: capture → transmission → processing → storage → destruction
PAN storage locations: databases, logs (log scrubbing!), backups, email/ticket systems, dev/test environments
Verify truncation/masking everywhere PAN appears; confirm no SAD (sensitive auth data) persistence post-authorization

Cardholder Data Environment: all systems that store/process/transmit CHD, plus connected systems
Identify connected-to systems: security-impacting (shared services like AD, DNS, NTP, monitoring) and security-impacting-or-not based on their ability to impact CDE security
Everything with potential CDE connectivity is in scope until segmentation is proven

Document segmentation controls: firewalls, network access control, separate credentials/privileged accounts for CDE
Segmentation penetration test is mandatory (v4.0): verify from out-of-scope zones that CDE boundaries hold, both directions
If no segmentation: entire network is the CDE. Usually more expensive than segmenting.

Req 1/2: network controls, secure configurations (now with defined "defined approach" targets)
Req 3: protect stored account data; cryptography inventory and key management (3.6/3.7 expanded)
Req 4: strong cryptography in transit — new in v4.0: PAN over open networks needs rendering unreadable (4.2.1)
Req 8: MFA for all access into CDE (8.4 expanded beyond admin)
Req 10/11: logging + testing; targeted risk analysis for customizing frequencies (11.3.x)
Req 12: policy, third-party/service provider management, customizes approaches documented

Data-flow diagrams, scope document with in/out-of-scope justification, segmentation test plan, and a requirements evidence matrix.