Franchise Retailer Scope After Tokenization Rollout
A 420-store franchise retailer accepts cards at POS terminals on each store LAN. Store routers connect over MPLS to a central data center, where a payment gateway encrypts PANs and returns tokens; the gateway is managed by a PCI-validated service provider. The retailer's QSA has scoped the CDE to the data center only, arguing that stores never store, process, or transmit PAN in clear text. However, 38 stores still use stand-alone dial-out terminals for gift-card activation, and those terminals are not on the MPLS network. Store back-office PCs authenticate to central Active Directory domain controllers, and inventory wireless scanners share VLAN 20 with POS terminals in 210 stores. The franchise agreement requires franchisees to follow the retailer's security policy, but franchisees control local firewalls and Wi-Fi. The QSA plans to sample 12 stores and 2 domain controllers. The retailer wants to exclude all store LANs from scope before the next assessment.
1. Evaluate the QSA's proposed CDE boundary. Which store-side systems and networks should be in scope, and why?
Read the worked answer
The data-center-only boundary is not defensible. The CDE includes systems that store, process, or transmit CHD, plus systems that are connected to or could impact the security of the CDE. Store POS terminals transmit PAN to the gateway, so they are at least connected-to systems; the transmission path, store routers, and MPLS handoff cannot be excluded without validated segmentation. The 38 dial-out terminals process PAN directly and are in scope, along with their phone lines and local support systems. VLAN 20 is shared between POS and inventory scanners in 210 stores, so the scanner network is not segmented from the CDE; a compromised scanner could reach POS traffic. Store back-office PCs authenticate to the same domain controllers used by CDE systems, and franchisee-controlled firewalls and Wi-Fi make segmentation inconsistent across stores. The QSA must document which controls compensate for the shared VLAN and franchisee autonomy, or bring those systems into scope. Sampling only 12 stores may miss the dial-out and shared-VLAN populations; sampling should be stratified by store format, terminal type, and network design. Excluding all store LANs would understate scope and leave connected-to controls untested.
2. What evidence should the PFI request to validate segmentation and scope, and how should sampling be adjusted?
Read the worked answer
Request current network diagrams, VLAN and switch configurations, firewall rules at store and data-center boundaries, MPLS routing tables, and the payment gateway's PCI attestation showing where PAN is decrypted and tokenized. Obtain an inventory of all POS and dial-out terminals by store, including phone-line records, and a list of stores where wireless scanners share the POS VLAN. Ask for Active Directory tiering and authentication logs showing which store systems can authenticate to CDE domain controllers. Validate segmentation with configuration review and technical testing: attempt to reach POS VLANs from scanner VLANs, test store-to-data-center paths, and capture traffic at representative stores to confirm no clear-text PAN is present outside approved flows. Sampling should be risk-stratified rather than random: include all unique store network designs, at least a sample of the 38 dial-out stores, stores with shared VLAN 20, and stores with franchisee-managed firewalls. If franchisees vary controls, sample across franchisee groups. Document compensating controls where segmentation cannot be proven, and escalate any store LAN that cannot demonstrate isolation from the CDE.