What network segmentation is
Network segmentation divides your network into separate areas and controls which systems can communicate across them. For payment security, the key boundary is between the Cardholder Data Environment (CDE), which stores, processes or transmits cardholder data, and the rest of your network.
For example, you can place payment terminals and the systems they need to reach in a restricted segment, separate from guest Wi-Fi and ordinary office computers. Segmentation is a security control, not a guarantee that the network or the CDE is secure.
A VLAN is only a divider; the rules controlling traffic across it determine whether your payment systems are truly isolated.
How the boundary works
A segment can be physical, such as devices connected through separate network equipment, or logical, such as a virtual LAN (VLAN). Firewalls, access control lists and other equivalent controls govern traffic between segments. A VLAN by itself does not control which traffic crosses the boundary.
Set the rules to allow only the specific users, devices and communication the payment systems need. Block other connections by default, including unnecessary remote access. If an office computer or guest device can reach the CDE through an allowed path, it remains relevant to the security boundary.
How segmentation affects PCI DSS scope
PCI DSS v4.0.1 is the current version as of 2026. Segmentation can reduce the systems included in your PCI DSS assessment by separating systems that do not store, process or transmit card data from the CDE. That narrower scope can also reduce the work involved in applying and maintaining controls.
The boundary has to work in practice. A forgotten connection, broad firewall rule or shared administrative route can bring other devices back into scope. Keep a network diagram and an inventory of payment-related systems, then verify that systems outside the CDE cannot reach it through direct or indirect paths.
What it means for your costs and risk
Network segmentation is not a card-network fee or a standard card-processing charge. Its financial effect comes from security and compliance work: a smaller, well-defined assessment scope can mean fewer systems to assess and fewer systems requiring PCI DSS controls.
Segmentation also limits how far a breach or malware infection can spread when rules are properly enforced. It does not replace other PCI DSS requirements, and it does not automatically remove a system from scope just because you placed it on a separate VLAN.
What you can actually change
You control which systems connect to payment systems and how those connections are restricted, documented and tested. Keep the CDE limited to systems with a clear business need.
- Map payment data flows and identify every device and system that stores, processes or transmits cardholder data.
- Use firewall or equivalent rules to allow only documented, necessary traffic between the CDE and other network segments.
- Test that systems outside the CDE cannot reach it through direct connections, remote access or management systems.
- Review diagrams, access rules and connected systems after network changes, and remove access that no longer has a business purpose.
- Map the CDE. List the devices and systems that touch cardholder data, along with the connections they need to do their jobs.
- Restrict cross-network traffic. Configure your network controls to permit only documented connections into and out of the payment environment.
- Verify the boundary. Test that devices outside the CDE cannot connect through remote access, management systems or other indirect paths.
Frequently asked questions
Does PCI DSS require network segmentation?
PCI DSS does not require every business to segment its network. Without segmentation, more of your network can fall within the assessment scope. If you use segmentation to exclude systems from scope, the boundary must effectively prevent out-of-scope systems from reaching the CDE.
Does a VLAN alone count as network segmentation?
A VLAN separates devices logically, but it does not by itself control traffic between segments. Use firewall rules or equivalent controls to allow only the connections your payment systems need, and test that other paths are blocked.
Can network segmentation lower my PCI compliance costs?
It can reduce the number of systems included in your PCI DSS assessment when the boundary is effective and verified. That can reduce assessment and control work, but the savings depend on your network and the cost of implementing and maintaining the controls.