PCI DSS Network Segmentation

Network segmentation is not a PCI DSS requirement, but it is the single most effective way to reduce your compliance scope and cost. By isolating systems that store, process, or transmit cardholder data from the rest of your network, you limit which systems fall under PCI DSS requirements.

Why Segmentation Matters

Without segmentation, your entire network is in scope for PCI DSS. Every server, workstation, and network device must comply with all applicable requirements. With effective segmentation, only systems within the cardholder data environment (CDE) and systems connected to the CDE are in scope. This dramatically reduces the number of systems, the compliance effort, and the cost.

Designing Segmentation

Effective segmentation requires identifying all locations where cardholder data exists, defining the CDE boundary clearly, implementing network controls (firewalls, ACLs, VLANs) that prevent out-of-scope systems from communicating with the CDE, and controlling all access paths into the CDE.

Segmentation Methods

Firewalls provide the strongest segmentation when properly configured. Dedicated firewalls between the CDE and other network segments with explicit deny-all rules and carefully managed allow rules are the gold standard.

VLANs with ACLs provide logical segmentation but must be combined with access control lists to be effective. VLANs alone are insufficient because VLAN-hopping attacks exist.

Cloud segmentation in AWS, Azure, or GCP uses VPCs, security groups, network policies, and service meshes. Cloud-native segmentation can be highly effective when properly configured and monitored.

Validating Segmentation

PCI DSS requires segmentation penetration testing at least every six months for service providers and annually for merchants. The test must verify that segmentation controls are operational and effective — that out-of-scope systems genuinely cannot reach the CDE.

Common Mistakes

Flat networks where everything can talk to everything. Overly permissive firewall rules that negate segmentation. Forgetting about management networks, backup systems, and logging infrastructure that may connect to the CDE. Failing to validate segmentation regularly.

In the next lesson, we will cover the changes in PCI DSS v4.0.