Network Segmentation: The Fastest Way to Shrink PCI Scope
PCI-DSS doesn’t require segmentation, but almost nothing else moves the needle on assessment cost and control burden as much. Here’s why it works, how it’s typically built, and the one thing the standard insists you prove with an actual attack, not a network diagram.
Why Segmentation Reduces Scope
Without segmentation, every system on a flat network that could potentially reach the cardholder data environment (CDE) is in scope for PCI-DSS — every workstation, every server, every piece of software, regardless of whether it ever actually touches card data. Segmentation isolates the CDE so that only the systems that genuinely store, process, or transmit cardholder data (and the systems that could affect their security) fall inside the assessment boundary. A well-segmented environment can turn a company-wide assessment into a review of a handful of systems.
Common Segmentation Architectures
VLAN + Firewall/ACL Isolation
The most common approach: the CDE lives on its own VLAN, with a firewall or router ACLs enforcing default-deny between it and every other network segment, permitting only explicitly required traffic in either direction.
Physical Network Separation
Dedicated physical switches, cabling, and (where feasible) dedicated internet circuits for CDE systems, with no shared infrastructure with the general corporate network. Simplest to reason about, most expensive to build and maintain, and still common for standalone terminal environments (SAQ B-IP).
Cloud Security Groups / NSGs
In cloud environments, security groups, network security groups, and cloud-native firewalls enforce the same default-deny boundary logic without physical infrastructure. PCI DSS v4.0’s shift from “firewall” to “network security controls” terminology explicitly recognizes this pattern.
Microsegmentation / Zero Trust
Software-defined policies enforce segmentation at the workload or host level rather than the network perimeter, allowing tighter east-west isolation within the CDE itself — useful in dense, virtualized, or containerized environments where VLAN boundaries alone leave gaps.
P2PE Encryption as Scope Reduction
A validated Point-to-Point Encryption solution encrypts card data at the point of capture, meaning the merchant’s own network never sees clear-text cardholder data — a different mechanism than network segmentation, but one that produces a similar scope-reduction outcome. See SAQ P2PE.
Jump Hosts / Bastion Access
Administrative access into the CDE is routed exclusively through hardened, monitored jump hosts rather than direct connections from general corporate endpoints — reducing the population of systems whose compromise could reach the CDE through an admin path.
A Network Diagram Is Not Proof — a Penetration Test Is
PCI-DSS Requirement 11.4.5 is the one control in the standard that insists segmentation be proven with offensive testing rather than documentation review. A qualified tester sits on an out-of-scope network segment and actively attempts to route, scan, and connect into the cardholder data environment — confirming that firewall rules, ACLs, and other segmentation controls actually stop them, not just that they’re configured to.
At least every 12 months, and after any change to segmentation controls.
At least every 6 months, and after any change to segmentation controls.
The core compliance principle that falls out of this requirement: a system is only truly out of scope once segmentation testing has proven it cannot reach the CDE. Until that test exists and passes, an assessor is entitled to treat the “out of scope” claim as unproven and pull the system back into the assessment boundary.
CORE Builds It, SENTRY Watches It, VERITY Documents It
CORE managed IT services designs and implements the segmentation architecture — VLAN and firewall rules, cloud security groups, or microsegmentation policy, matched to the environment rather than forced into a one-size template. SENTRY then monitors for configuration drift and unauthorized changes to segmentation controls between annual tests, since a single misconfigured firewall rule can silently collapse months of scope-reduction work.
VERITY coordinates the annual (or semi-annual, for service providers) Requirement 11.4.5 penetration test with a qualified tester and maintains the documentation trail an assessor expects: the segmentation methodology, the test scope, the findings, and evidence of remediation for anything the test surfaces.