01
Payment Flow Mapping
Document how payment account data enters, moves through and exits the organisation across ecommerce, point-of-sale, MOTO and other channels.
PCI DSS Scoping Services
Get the PCI DSS Scope Right Before You Start Fixing Controls
If the Cardholder Data Environment is defined too broadly, you can create unnecessary cost and work. Define it too narrowly and critical systems may be missed.
2-sec maps how account data enters, moves through and leaves your organisation, then identifies the systems, people, locations and third parties that store, process, transmit or can affect the security of that environment.
Scope Drives Everything
The Quality of the PCI DSS Programme Starts With the Boundary
PCI DSS scoping identifies the people, processes and technologies that store, process or transmit account data, plus system components that can affect the security of the Cardholder Data Environment.
Accurate scope determines what must be assessed, what evidence must be maintained and where security controls need to operate. Effective segmentation or changes to payment architecture can sometimes reduce assessment scope, but those decisions need to be technically defensible and properly validated.
Scoping Work
Map the Payment Environment Before You Map the Controls
A scoping engagement creates a shared, evidence-backed understanding of the CDE and the systems that influence it.
02
Asset and System Review
Identify applications, endpoints, servers, network zones, cloud services and security systems connected to or able to affect the CDE.
03
Third-Party Mapping
Identify payment processors, gateways, cloud providers, managed services and other TPSPs involved in payment or security functions.
04
Segmentation Review
Assess how the CDE is isolated and where segmentation or architecture changes could create a defensible reduction in assessment scope.
05
Data Reduction Opportunities
Identify unnecessary storage, transmission or handling of account data that could be removed or outsourced.
06
Scoping Record and Roadmap
Produce a clear scope baseline and recommended next steps for gap analysis, remediation or formal validation.
What We Map
PCI Scope Is More Than a List of Servers
The scoping exercise needs to understand the operating model around payments, not just network diagrams.
Payment ChannelsEcommerce, point-of-sale, telephone, recurring payments and other account-data flows.
Cardholder DataWhere account data is stored, processed, transmitted, displayed or retained.
Connected SystemsSystems with connectivity or security impact on the CDE.
People and RolesStaff and administrators whose access or responsibilities affect payment security.
LocationsOffices, retail sites, data centres, cloud regions and other relevant environments.
Third PartiesProcessors, gateways, hosting, SaaS, support and managed-security providers.
Network BoundariesSegmentation controls and pathways between in-scope and out-of-scope networks.
Future-State ChangesPlanned payment, cloud or infrastructure changes that could alter PCI scope.
How 2-sec Approaches It
A Defensible PCI DSS Scope in Five Steps
01
Discover Payment Flows
Understand every way the organisation accepts, processes and supports payment activity.
02
Identify the CDE
Map systems, people, technologies and locations that handle or can affect account data.
03
Challenge the Boundary
Look for unnecessary data handling, weak segmentation and architectural opportunities to reduce exposure.
04
Validate Dependencies
Review third parties, security services and connected systems that influence scope.
05
Document the Baseline
Create the scope record and use it to drive gap analysis and validation planning.
Before you spend money fixing PCI controls, make sure those controls are actually in the right scope.
Book a PCI Scoping Review ↗PCI Scoping Questions
Frequently Asked Questions About PCI DSS Scoping
Can network segmentation reduce PCI DSS scope?
Yes. PCI SSC states that adequate segmentation can reduce assessment scope when it isolates systems that store, process or transmit cardholder data from other systems. The controls must be effective and the reduced scope must be defensible.
Does outsourcing payment processing remove us from PCI DSS?
Not automatically. Outsourcing can materially reduce the systems that handle account data, but merchants still have responsibilities and must understand how third parties and their own systems affect payment security.
What is included in the Cardholder Data Environment?
The CDE includes people, processes and technologies that store, process or transmit account data, as well as system components that can affect the security of those systems.
Do connected corporate systems become in scope?
They can. If systems are not adequately isolated from the CDE, or can affect its security, they may be included in PCI DSS scope.
Should scoping happen before a gap analysis?
Yes. Assessing controls before the scope is understood risks testing the wrong systems or overlooking systems that should have been included.
Continue Your PCI DSS Journey