PCI DSS Scoping

Correct scoping is 80% of PCI DSS. Get the data flows right first.

1. Find the Cardholder Data

• Trace the full payment path: capture → transmission → processing → storage → destruction
• PAN storage locations: databases, logs (log scrubbing!), backups, email/ticket systems, dev/test environments
• Verify truncation/masking everywhere PAN appears; confirm no SAD (sensitive auth data) persistence post-authorization

2. Define the CDE

• Cardholder Data Environment: all systems that store/process/transmit CHD, plus connected systems
• Identify connected-to systems: security-impacting (shared services like AD, DNS, NTP, monitoring) and security-impacting-or-not based on their ability to impact CDE security
• Everything with potential CDE connectivity is in scope until segmentation is proven

3. Segmentation (the scope killer)