PCI Scope and a Frozen Capital Budget
A 180-store specialty retail chain runs an open guest SSID in every store. Store networks are flat: the POS terminal, back-office PC, IP cameras and guest clients all sit on the same Layer 2 VLAN behind a consumer-grade router. The acquiring bank has scheduled a PCI DSS assessment in 90 days, and the QSA has flagged the flat network and open SSID as scope-expanding. The store platform refresh is two years away and the CFO has frozen capital spending. The CISO wants cardholder data segmented now. Loss prevention also wants iPads on the guest network for inventory counts, and store managers have shared the guest PSK with neighboring businesses. Staff turnover is high and stores have no directory service, only a cloud identity provider.
1. What segmentation can realistically be achieved with no capital spending, and what are its limits?
Read the worked answer
The goal is to shrink the cardholder data environment (CDE) to the POS and its immediate supporting systems, and to prove a controlled boundary between it and guest traffic.
Achievable with existing equipment, if the store router supports multiple SSIDs mapped to VLANs and access control lists:
- Create a dedicated POS VLAN and a dedicated guest VLAN. Map each SSID to exactly one VLAN; never bridge guest to the POS subnet.
- Put an ACL or firewall rule between the two: deny guest-to-POS and guest-to-back-office in both directions, permit only the POS outbound flows the payment application needs, and enable client isolation on the guest SSID so guests cannot reach each other or the iPads' management interface.
- Disable WPS and any default admin credentials on the router, and move management to a separate management VLAN or out-of-band access.
- Document the boundary with a network diagram, rule sets and configuration exports - the QSA needs evidence, not intent.
Limits: a consumer router's ACLs may not be a true stateful firewall, and PCI scope reduction requires the segmentation control to be robust and tested. If the router cannot support VLANs or ACLs, the credible no-capex step is to remove guest Wi-Fi from that device entirely and place guest on a physically separate access point and ISP path, keeping the POS network untouched. Anything less is a compensating control, not segmentation, and should be presented as such.
2. How do you handle the shared PSK and the iPads without a store directory service?
Read the worked answer
The shared guest PSK is a policy and identity failure. Any PSK that staff, neighbors and contractors know cannot be treated as an access control, and rotating it monthly without enforcement just creates helpdesk load.
Recommended approach:
- Guests and iPads: use an open or captive-portal SSID with client isolation, bandwidth limits and a time-limited voucher, sponsored by the store manager. Inventory iPads then reach only their cloud service over the internet, so they do not need internal access at all - confirm that with the application owner rather than assuming it.
- Staff devices: if any staff need internal resources, give them a separate SSID authenticated against the cloud identity provider. Many cloud IdPs support RADIUS or SAML-based Wi-Fi via a proxy, which avoids on-premises AD. If that is not feasible in 90 days, use per-store unique, rotated credentials for a staff SSID and log their issuance.
- POS devices: certificate-based 802.1X where the terminal supports it, or MAC-based admission with strict ACLs as a documented interim control.
Write the policy explicitly: no sharing of guest credentials, guest access is internet-only, and POS devices are never permitted on guest SSIDs. Train store managers on the voucher process so they stop distributing the PSK.
3. The CFO rejects spending and says "we have never had a breach." How do you frame the decision?
Read the worked answer
Frame it as a business decision with quantified exposure and a costed set of options, not as a compliance lecture.
- Quantify the downside in the CFO's terms: card brand fines and assessments per violation, forensic investigation costs, card reissuance, potential loss of the ability to accept cards, and the contractual position with the acquirer. Present ranges, cite the source of each figure, and be explicit that the acquirer can terminate processing.
- Show that the cheapest option is not 'do nothing'. Compare: (a) no action, with the assessed risk of failing the assessment and losing processing; (b) no-capex configuration and policy work with the existing router, plus documentation; (c) a small per-store firewall or managed switch purchase, with a per-store unit cost multiplied across 180 stores; (d) waiting for the platform refresh in two years, with the risk carried until then.
- Point out that (b) is inside the freeze. The QSA findings are mostly configuration and policy: VLAN separation, ACLs, guest isolation, credential handling, documentation. That work costs staff time, not capital, and it materially reduces scope now.
- Ask for a decision, not approval: if the CFO accepts the residual risk, record it formally as a risk acceptance with an owner and a review date. That protects the CISO and gives the QSA evidence of governance, which is itself an assessed control.