Segmentation Before a Change Freeze in a PCI Environment

I would treat this as a boundary-enforcement problem, not a VLAN project. First, map actual flows for the payment API, database, jump hosts, and reporting database using existing flow logs and firewall sessions. Without that dependency map, a deny-by-default rule will break payments. Second, define the CDE boundary explicitly: the API subnets, database subnets, and administrative jump hosts. Third, enforce AWS security groups and host firewalls deny-by-default between CDE and non-CDE workloads, allowing only required application ports and administrative paths from jump hosts. Fourth, use switch ACLs to block marketing and corporate subnets from initiating SMB to CDE servers. Fifth, put explicit FortiGate rules between data centre and AWS so only known API and management traffic crosses. New VLANs are unnecessary for immediate risk reduction; logical policy enforcement is faster and reversible. I would not claim “microsegmentation” is complete-only that compensating controls reduce the blast radius before the freeze.

I would isolate the exception rather than exempt the whole CDE. Place the database behind a switch ACL or firewall rule that permits SMB only from the specific database host to the specific finance share, and only during the known reporting window if batch jobs allow. Document the owner, business justification, expiry date, and compensating controls: network monitoring for SMB anomalies, restricted administrative access, and a required replacement plan. I would test the rule during a non-month-end cycle and capture rule hit counts to prove it is working. Because PCI scope follows the card data, the exception must not create a path from marketing or the internet to the database. If the vendor cannot support a host firewall, the network control becomes the primary segmentation point, and the risk should be accepted by the business owner with a dated remediation milestone.

I would present evidence that tests the policy from the attacker’s likely starting point. That includes vulnerability scan results from the marketing subnet showing SMB and management ports blocked to CDE hosts; firewall and security group logs showing deny hits from non-CDE sources; flow logs confirming only approved application and administrative paths; and rule hit counts proving required traffic still works. I would also show a sample of change records, the approved flow matrix, and negative tests for jump-host access. Configured rules alone are weak evidence because a permissive rule can exist without being exercised. Effective segmentation evidence combines a documented intended policy, automated tests, and operational logs showing both allowed and denied traffic behave as designed.