PCI SSCPCI DSSScoping SegmentationEASYFree question
Is network segmentation required by PCI DSS?
- A.No, it is not required but is strongly recommended as it reduces the scope and cost of PCI DSS compliance
- B.Yes, it is required for service providers and issuers handling PANs, but merchants on a validated P2PE solution can skip it
- C.It is mandatory under Requirement 1.2, but assessors accept a flat network if the scope statement is signed, dated, and retained
- D.Yes, for entities above Level 2, but smaller merchants and service providers are exempt
Why A is correct
PCI DSS does not mandate network segmentation, but it is strongly recommended. Without segmentation, the entire network is in scope for PCI DSS, significantly increasing compliance burden and cost.
Know someone studying for PCI DSS? Send them this one.