PCI SSCPCI DSSScoping SegmentationEASYFree question
What happens to PCI DSS scope if an organization does NOT implement network segmentation?
- A.Only the segments that carry authorization traffic and the databases holding PANs fall into the assessment
- B.The network edge and every system behind the perimeter firewall are reviewed while internal switches stay outside the assessment
- C.The entire network and all connected system components are considered in scope for PCI DSS assessment
- D.Just the payment application servers and all databases that log transaction metadata fall under the assessment boundary
Why C is correct
Without network segmentation, PCI DSS scope extends to the entire network, meaning all system components must be assessed and comply with applicable PCI DSS requirements.
Know someone studying for PCI DSS? Send them this one.