Lesson 3.68: PCI DSS v4.0: scope and segmentation
Any organisation that stores, processes or transmits payment card data must protect it under PCI DSS, the industry standard maintained by the PCI Security Standards Council. Version 4.0 replaced 3.2.1 (retired on 31 March 2024), and its future-dated requirements became mandatory on 31 March 2025. The most important decision is scope: the cardholder data environment (CDE) plus every system connected to it must meet the requirements, and only tested network segmentation can keep the rest out. In the lab you identify the CDE and its connected systems from Northwind's inventory and flows, read the segmentation test and decide the scope.
18 min
You will learn to
- Explain the CDE and connected-to systems
- Identify the CDE from data flows and storage
- Find systems connected to the CDE
- Read a segmentation test and spot a failure
- State the resulting PCI DSS scope
Key terms
- PCI DSS
- Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council.
- PAN
- Primary account number: the card number.
- CDE
- Cardholder data environment: systems that store, process or transmit card data.
- Connected-to system
- A system that can connect to or affect the CDE; in scope.
- Segmentation
- Network controls that isolate the CDE; reduces scope only if tested.
- QSA
- Qualified Security Assessor: an assessor certified by the PCI SSC.
← Security awareness that measures the right things · All lessons · Important business services and impact tolerances →