PCI DSS: understanding and defining the assessment scope

Start with card data and its journey

PCI DSS concerns the protection of payment card data. The assessment scope depends on where card data is stored, processed or transmitted, and which systems are connected to or can affect the security of that environment.

Map the flow from collection through payment and storage to erasure. Include integrations, administrative connections and relevant logs and backups. A server map is not enough if the people and processes around the servers are left out.

Scope boundaries need to be demonstrable

Network segmentation and other controls can help define the environment's boundaries. What matters is how the separation works in practice and how it is verified. Document connections, permissions and dependencies, and test the boundaries when the solution changes.

Tokenisation can change the data flow

Tokenisation replaces a sensitive value with a reference: a token. Systems that only need the reference can then avoid handling the original card number.

The scope does not disappear automatically. The tokenisation service, the ability to reconstruct or retrieve card data and connections to the payment environment must be included in the assessment. Validate the solution with the expertise and assessment appropriate to your business.

The provider's evidence is part of the assessment

Outsourcing does not remove all the customer's obligations. Clarify which responsibilities the provider takes on and which controls you need to manage yourselves. Request a current Attestation of Compliance, AOC, where relevant, and check that it covers the service you actually use.

• Which data and systems does our solution cover?
• Which security controls does each party provide?
• What current evidence supports the provider's scope?
• How do we identify changes that affect the assessment?