Our organization is in process of determining if our PCI DSS scope is correct. We have done lots of research and read the Open PCI DSS Scoping Toolkit document. However, we still struggle to fully understand it.

We have the CDE servers segregated on its own VLAN behind the internal firewalls. Only the CDE environment is behind these firewalls. We understand that all 12 requirements apply to this segment (1a devices).

Q1. We have devices outside our PCI segment that provide services to PCI segment. This includes Active Directory, SIEM, and Anti-Virus. To us it seems these devices belong to “2a” category and are in scope. The toolkit states that all applicable PCI controls are required for Category 1 and 2a systems. Does that mean that we have to move all these devices behind the firewall into the CDE environment? Or can we leave it as is, and protect these servers with all applicable PCI controls (also introduce the hardening standards) and then document all required ports that are required to be opened on the firewall in order for these servers to provide required services to our CDE environment?

Q2. One of our larger departments functions in a call center fashion. They take card data via phone and then enter it to software that is installed on their PC. This software connects to the server in CDE environment. Nothing is stored locally on the PC. Everything is submitted and stored on this one server in CDE environment. The connection between the PC and the server is encrypted. Additionally, after the data has been entered, if the center representative went back in to check the card number, they would be able to see only the last 4 digits for verification purposes. Our question is about these PCs (we understand they are in scope), but do we need to move them inside the CDE environment where the server is located or leave them where they are at, and apply all applicable PCI controls and host based hardening controls (FIM, SIEM, anti-virus, patching, access controls, monitoring, etc). There is only 1 port required for the PC (software on the PC) to communicate with the server within the CDE segment. That is the only port we allow through the firewall and we have it documented.

Thank you so for your help.

1 Answer 1


Response to Q1

The network segments containing systems which handle cardholder data should be in their own VLANs - it appears you've done this. The systems which are connected to and security impacting are also in scope but don't need to be within the CDE as they don't handle cardholder data. Those systems can be individually in scope without bringing the population of that network segment into scope. It would be useful to have local firewalls enabled as an additional security measure.

Response to Q2

The call centre should be in its own VLAN so it's logically segmented from environments which don't handle cardholder data. The call centre is part of your CDE.

Considering the above you may have the following VLANs:

  • CDE internal
  • CDE call centre
  • Other stuff - may contain in-scope systems i.e. connected to, security impacting
  • Other
  • Thank you so much for your answer Andy. Just a couple of clarification questions. What about the systems that can communicate with the security systems such as SIEM and Anti-Virus, but are not in scope for PCI? (These systems however cannot communicate directly with CDE environment.) The call center PCs do have an internet access...does PCI allow that? Or is it just that servers in CDE are not allowed the internet access?
    – Fox2020
    Jun 19, 2016 at 5:28
  • Ensure you have proper access control on SIEM and anti-virus using named accounts. You shouldn't have to worry about systems communicating with them though local firewalls on those [SIEM and AV] systems would be a good idea. Also you do need to do vulnerability scanning/management of the SIEM and AV systems etc. The call centre PCs are permitted to have internet access if it's justified - you could blacklist or whitelist or provide full access and go through a proxy for monitoring. Note - servers in the CDE are permitted internet access that's authorised - see requirements within 1.3.x
    – AndyMac
    Jun 20, 2016 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .