Scope reduction first, then segmentation, access control, and the evidence your acquirer asks for — because every system that touches card data is a system you have to defend.
The Real Problem
Most organizations assume PCI applies only to the payment terminal. Then someone takes a card number over the phone and writes it on a pad. Someone emails an order form. A spreadsheet holds numbers “temporarily.” Each of those quietly pulls another system, and another employee, into scope — and scope is what determines both your obligation and your cost.
So the first move is almost never to add controls. It’s to stop touching the data at all wherever possible, and shrink the footprint you have to defend.
What’s Included
An honest map of every place card data is captured, transmitted, or stored — including the informal paths.
Routing payment capture so your general environment falls out of scope wherever it can.
The cardholder environment isolated from the rest of the network, so a general compromise doesn’t reach it.
Restricted, individually attributable access with retained logs, as the standard requires.
Patching and scanning cadence maintained rather than run once before an assessment.
Help completing the right self-assessment questionnaire with evidence that supports the answers.
Common Questions
Usually reduced, rarely eliminated. If staff ever handle card numbers by phone, email, or paper, those paths are in scope regardless of who processes the transaction.
No. We implement and maintain the controls and evidence; formal validation comes from a qualified assessor or the appropriate self-assessment.
The answer usually includes at least one path nobody documented. We’ll map it with you.
