Frequently Asked Question

At a high level, adequate network segmentation isolates systems that store, process, or transmit cardholder data from those that do not. Network segmentation can be achieved through a number of physical or logical means, such as properly configured internal network firewalls, routers with strong access control lists, or other technologies that restrict access to a particular segment of a network.

To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that even if the out-of-scope system component was compromised it could not impact the security of the CDE. It should be noted that the adequacy of a specific implementation of network segmentation is highly variable and dependent upon a number of factors, such as a given network's configuration, the technologies deployed, and other controls that may be implemented.  Refer to the PCI DSS “Scope of PCI DSS Requirements” section for additional guidance.

Additionally, if segmentation is used to reduce PCI DSS scope, an entity’s penetration testing activities (per PCI DSS Requirement 11.3) must include testing of the segmentation controls, to verify they are operational and effective.