What PCI scoping is
PCI scoping defines what your business must include in a PCI DSS assessment. It covers systems, people and processes that store, process or transmit cardholder data or sensitive authentication data, plus systems that connect to or affect the security of that data.
Your Cardholder Data Environment (CDE) is the systems that store, process or transmit cardholder data or sensitive authentication data. Scoping is the broader decision about what must be assessed: connected or security-impacting systems can also be in scope even when they do not handle card data themselves.
A system does not need to handle card data to be in scope; access to the CDE or influence over its security can be enough.
How you determine what is in scope
Start by tracing every payment channel, including in-person, phone, mail and e-commerce, from card entry through storage, transfer or destruction. Record where data moves and identify the terminals, websites, applications, databases, cloud services and staff involved.
Include systems that can access the CDE, change its security, provide security services or support PCI DSS requirements. For example, a firewall or authentication server can be in scope because it protects access to payment systems. A system is out of scope only when it meets all applicable exclusion conditions, including no card-data handling, no CDE connection and no ability to affect CDE security.
Why segmentation and website design matter
Network segmentation can reduce the number of systems in scope, which can lower assessment effort and the work required to maintain controls. Segmentation is not itself a PCI DSS requirement, and placing systems on separate VLANs does not prove they are separated. When segmentation reduces scope, your assessor must validate it, and segmentation controls must be penetration-tested at least annually.
Your online payment design also affects scope. Under PCI DSS v4.0.1, requirements 6.4.3 and 11.6.1 address payment-page scripts and detection of unauthorized changes. A merchant webpage that includes an embedded payment form can bring the merchant's own page scripts into scope, even when the processor is responsible for scripts inside the embedded form.
What you can actually change
You control how clearly your payment environment is mapped and how much access it gives to payment systems. Accurate diagrams and verified segmentation can reduce the assessment footprint without treating out-of-scope systems as risk-free.
- Map each payment channel and follow card data from entry to transfer, storage or destruction.
- Inventory the systems, service providers, processes and staff that handle card data or affect CDE security.
- Separate systems that do not need CDE access, then document and test the segmentation controls.
- Record how your payment page uses redirects, iframes and scripts, and update the scope when that design changes.
- Draw data flows. Trace card data through each sales channel and mark every system, service and role it touches.
- Prove separation. Keep network diagrams and test results showing that systems labeled out of scope cannot reach or secure the CDE.
- Review changes. Revisit scope when you add a payment channel, change a website or network, or introduce a new service provider.
Frequently asked questions
What does PCI scoping include?
PCI scoping includes systems, people and processes that store, process or transmit cardholder data or sensitive authentication data. It also includes systems connected to the CDE or able to affect its security, such as firewalls and authentication services.
Can network segmentation reduce PCI scope?
Yes. Effective segmentation can keep systems that do not need payment-data access outside the assessment scope. Separate VLANs alone do not prove segmentation; controls must block the relevant paths, and segmentation used to reduce scope must be validated and penetration-tested at least annually.
Is PCI scoping the same as defining the CDE?
No. The CDE consists of systems that store, process or transmit cardholder data or sensitive authentication data. PCI scoping also considers connected systems, security-impacting systems, people and processes that must be included in the assessment.