PCI Scope in a Flat Retail Store
Fabrikam Retail has 120 stores. Each store uses a single /24: POS terminals (8), back-office PCs (6), IP cameras (12), guest Wi-Fi, and a store router. POS traffic goes over HTTPS to a payment gateway, but the PCI scope also includes the HQ payment application and database in a data center VLAN. A QSA says the stores are in scope because POS and guest users share a flat Layer 2 domain. The security team proposes VLANs on each store switch plus an ACL on the store router; the network team says a firewall per store is too expensive and the 12-year-old cameras cannot do 802.1X. Guest Wi-Fi must remain available for customers. There is a central next-generation firewall at the WAN edge, but store-to-store traffic currently goes through HQ. The retailer must reduce PCI scope before the next assessment in 90 days, without replacing store switches.
1. Does adding VLANs plus an ACL on the store router reduce PCI scope? Explain the conditions under which the QSA could accept it.
Read the worked answer
VLANs alone do not reduce scope; segmentation must be enforced and provable. A VLAN on the same physical switch is only a logical boundary, and if any interface can route or bridge between the POS VLAN and the guest VLAN without control, the QSA can treat the whole store as one scope. An ACL on the store router can be an acceptable enforcement point if all inter-VLAN traffic is forced through that router, the ACL permits only POS-to-payment-gateway HTTPS and required DNS/NTP, and it denies POS-to-guest, POS-to-camera, and store-to-store traffic. The switch itself must not have a route or a Layer 3 interface that bypasses the router. Guest Wi-Fi needs its own SSID mapped to a guest VLAN, client isolation, and no Layer 2 bridging to the POS VLAN. The 12-year-old cameras can stay in an untrusted IoT VLAN without 802.1X if that VLAN has no route to POS and is blocked at the router. The QSA will also want configuration evidence, change control, and segmentation testing, so document the enforcement point and test it, not just the VLAN plan.
2. Design the target store segmentation with specific zones, permitted flows, and enforcement points. Keep the existing store switch and router.
Read the worked answer
Use four zones: POS, back-office, IoT/cameras, and guest. The POS VLAN contains only the eight terminals and the payment-gateway route. Permit POS to the gateway on TCP 443, DNS to the internal resolver, and NTP to the approved server; deny all other outbound and all inbound. Back-office permits corporate applications through the HQ firewall but no access to POS. IoT/cameras permits only camera-to-NVR traffic, and if the NVR is local, keep it local; otherwise tunnel it to HQ without exposing POS. Guest gets internet only through a captive portal or isolated breakout, with client isolation and no route to any store VLAN. Enforce inter-zone policy on the store router with stateless ACLs and, where the router supports it, zone-based policy firewall. Use private VLANs or switchport protected on the access switch for guest isolation. Put the store switch management interface in a management VLAN reachable only from HQ. Send router and switch logs to the SIEM, and make the POS ACL default-deny with logging on denies.
3. Sequence the 90-day migration. What would you do in the first two weeks, and what residual risk would you report to the QSA?
Read the worked answer
In the first two weeks, inventory every store's switch and router model, current VLANs, and firmware; capture baseline configurations; and confirm which payment gateway IPs and ports are actually used. Do not change production until the flow matrix is signed off. Weeks 3-6: build the four VLANs, move cameras and guest first because they are lower risk, then back-office, and finally POS during a maintenance window. Apply the ACLs in log-only mode before enforcing them. Weeks 7-8: test from each zone, run segmentation tests, and fix any bypass found. Weeks 9-10: collect evidence and review with the QSA. Weeks 11-12: enforce and monitor. Residual risk to report: the store router is a shared enforcement point, so a router compromise or a misconfigured switch Layer 3 interface can collapse the segmentation; the old cameras may have known vulnerabilities and no 802.1X; and store-to-store traffic still traverses HQ, so the central firewall must enforce the same policy. Recommend a later store firewall or SASE refresh, but do not claim scope reduction until the ACLs are enforced and tested.