My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope. Specifically, we're looking to exclude our web merchandising software from PCI scope.
Of course, to make that happen, we'll have to ensure that the application servers never get cardholder information and that the application servers never "connect to" anything in the CDE.
We've talked to our QSA about it and he's mentioned that a lot of organizations do just that. But dispite much Googling, I can find little further evidence of this, let alone anything about best practices when undertaking such a project.
Is this (even remotely) a suitable way to go about approaching the problem? What should I know when going into a project like this? And, who else has written on the topic and what would I Google for to find more information?
Thanks in advance.