PCI DSS Requirements and Scope
What the domain tests
This domain checks whether you can bound a cardholder data environment (CDE) and map PCI DSS requirements to evidence. The exam favors scenarios where the stated diagram is incomplete and you must infer connected-to and security-impacting systems.
Core rules
- The CDE includes systems that store, process, or transmit account data, plus systems that can impact the security of the CDE (authentication, logging, virtualization, jump hosts, AV, patch management).
- Scope reduction is deliberate: segmentation, tokenization, P2PE, retention limits, and network isolation. Segmentation must be tested; annual penetration testing and retesting after changes are typical.
- The 12 requirements group into secure network, data protection, vulnerability management, access control, monitoring/testing, and policy. Requirement 3 is storage; Requirement 4 is transmission; Requirement 10 is logging; Requirement 11 is testing; Requirement 12.10 is incident response.
- Evidence includes data-flow diagrams, account-data discovery output, network diagrams, firewall rulesets, configuration standards, interview notes, and sampling results.
Worked example
A retailer says its POS LAN is segmented from corporate. The diagram shows one firewall, but the same Active Directory domain authenticates POS servers and corporate laptops, and the SIEM collects from both. Because a compromised laptop could use domain credentials to reach POS, the corporate AD and SIEM are connected-to systems. Scope shrinks only if segmentation is enforced and tested, not because a VLAN label exists.
Traps
Equating the CDE with only the PAN database; assuming outsourcing removes responsibility; treating a SAQ as proof of no scope; forgetting virtualization and management planes; accepting a diagram without config validation.