The Audit Finding That Started as a Network Diagram
A 320-store retail chain runs a flat Layer 2 network in each store, extended to the data centre over an L2VPN. PIN pads encrypt card data, but it is decrypted on a Windows store server that also hosts CCTV recording, the guest Wi-Fi controller and the pharmacy label printer. The QSA's draft report states the cardholder data environment is effectively the entire network. Reassessment is in seven months. CapEx is capped at USD 400,000 with four network staff, and the POS application cannot change this year. A facilities vendor also needs 24/7 remote access to HVAC controllers sitting on the same flat network. Stores average 15 POS terminals and 60 other endpoints.
1. Lay out a seven-month scope-reduction plan, including what to do about the L2VPN and why.
Read the worked answer
Kill the L2VPN; route at the store edge. A stretched broadcast domain means any device in any store can ARP and reach the POS subnet. Segmentation cannot be enforced across a shared Layer 2 domain, and the QSA will keep the whole estate in scope. Replace it with routed WAN links and a stateful firewall or segmentation gateway at each store edge. That single change is what makes every later control defensible.
Then split the store server's roles. CCTV, guest Wi-Fi and the label printer move off the CDE host onto separate VLANs and, where budget allows, separate hosts. Card data is decrypted only in a hardened CDE zone holding the POS server and its management path.
Timeline: months 0–1 discovery and documented target architecture; 1–3 pilot 10 stores and validate with a segmentation test; 3–6 wave rollout of roughly 100 stores a month with two staff on rollout and two on operations; 6–7 evidence collection and pre-assessment.
Budget guard: USD 400k across 320 stores is about USD 1,250 per store. Firewall appliances at that price point are feasible; new servers are not. Sequence accordingly.
2. How would you redesign the facilities vendor's remote access, and why does a shared-account VPN fail the assessment?
Read the worked answer
Why the current model fails: a shared VPN account is not attributable to a person, so no log proves who touched HVAC at 02:00, and it cannot be revoked for one departure without breaking the vendor. The credential also usually lands on the same flat network as POS - that is exactly the path used in several retail breaches where an HVAC vendor account was the entry point.
Design:
- Named accounts per vendor technician, federated to the vendor's identity provider, MFA enforced.
- Access through a jump host with full session recording and file-transfer controls, not a direct VPN pool.
- Least privilege: ACLs allowing only the specific HVAC controller IPs and management ports; the HVAC VLAN has no route to the CDE.
- Time-bound entitlement - access opens for a scheduled window and closes automatically; no standing 24/7 access.
- Approval workflow and monthly access review with the vendor's account manager.
HVAC stays outside the CDE regardless; the vendor path is a risk in its own right, not only a PCI scope question.
3. What residual risk will remain after the seven months, and how do you document it so the QSA accepts it?
Read the worked answer
Residual risk you will still carry:
- The POS application itself is unchanged, so the CDE host remains a Windows server with the same attack surface - segmentation reduces reachability, not vulnerability.
- Physical access to store cabling and switch cabinets by store staff.
- Devices that cannot be moved off the store server within budget (label printer is the likely survivor).
- Vendor access, even tightly controlled, remains an external trust path.
Documentation the QSA will expect: an updated data-flow and network diagram showing the CDE boundary; firewall rule exports and the change tickets behind them; a segmentation test - a scan and, ideally, a penetration test demonstrating that non-CDE hosts cannot reach CDE hosts; a risk register with owner, compensating control, review date and management sign-off for each accepted item; twelve months of retained logs; and evidence of quarterly rule reviews.
Frame each item as a control you chose, not as a gap you left. An accepted, owned and tested risk is a different finding from an unexamined one.