Clinic Chain PCI Scope Before Assessment
Valley Care is a 14-clinic outpatient chain with 2,100 employees. It accepts credit cards at 40 front-desk terminals and stores cardholder data in a payment processor's hosted iframe; however, one billing office still runs a legacy server that stores 9-digit PANs in a flat file for 90 days to reconcile chargebacks. The chain is preparing for PCI DSS v4.0 assessment and a HIPAA risk analysis. The network is flat: clinic workstations, medical devices, card terminals, and the legacy server share one VLAN per clinic. The CISO has budget for either network segmentation or tokenization, not both this year. The processor says it can tokenize card data in 6 months. The legacy billing application's vendor is out of business. The assessor will arrive in 90 days.
1. Which project should the CISO fund, segmentation or tokenization, given the 90-day assessment? Justify the choice.
Read the worked answer
Fund segmentation now; schedule tokenization as the follow-on. In 90 days, tokenization cannot remove the legacy flat file because the processor needs 6 months, so the assessment will still find PANs. Segmentation can reduce scope if the cardholder data environment is isolated: move the 40 terminals and legacy server to a dedicated VLAN, allow only required payment and billing flows, and block workstation-to-server and server-to-internet traffic. That does not erase the PAN storage problem, so pair it with immediate data minimization: truncate or hash the 9-digit PANs if chargeback reconciliation can use last four plus a token, restrict file access to two billing users, enable file integrity monitoring, and encrypt at rest. A segmented CDE still needs PCI controls, but the flat network no longer exposes medical devices and workstations to card data. Tokenization remains the durable fix and should be funded next year.
2. What compensating controls would you present for the legacy server, given the vendor is out of business? Explain what makes them defensible.
Read the worked answer
Compensating controls must be defensible, not just documented. The vendor is gone, so the application cannot be patched. First challenge the business need: most chargeback reconciliation can use the processor portal, so full 9-digit PAN storage may be unnecessary. If retained, isolate the server in the CDE VLAN with host firewall rules, remove internet access, require MFA for the two billing users, log all file reads, and review alerts daily. Encrypt the flat file with a key stored separately. Truncate PANs where possible and set a 30-day retention, not 90. Because PCI DSS does not permit storing sensitive authentication data after authorization, confirm the file contains only PANs and no CVV. Present the assessor with the business justification, risk analysis, and a dated remediation plan; otherwise the assessor may treat the storage as a scope-expanding violation rather than an acceptable compensating control.