CDE Scope Definition & Network Segmentation

Tap to enlarge

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

• Legal entity nameoptional

  orgLegalName

  The legal name of the entity being assessed, as it will appear on the AOC.

• Merchant ID (MID)optional

  merchantId

  The identifier your acquirer knows you by.

• PCI DSS versionoptional

  dssVersion

  The version in force for this assessment period.

• Assessment contact nameoptional

  pocName

  Enter assessment contact name.

• Assessment contact emailoptional

  pocEmail

  Enter assessment contact email.

• Merchant / Service Provider Leveloptional

  merchantLevel

  Set by your acquirer from annual transaction volume. Level 1 validates by ROC and no channel mix can downgrade that.

• Entity is a service provideroptional

  isServiceProvider

  Check if you store, process or transmit account data on behalf of another organisation. This forces a Report on Compliance and halves the segmentation retest interval.

Tap to enlarge

Complete the Payment Profile fields. Each value is validated against the schema before the next step unlocks.

• Payment channels in useoptional

  channels

  Every way account data reaches your environment, including channels a third party operates for you.

• Account data is stored anywhere in the environmentoptional

  storesCardholderData

  Storing account data disqualifies every reduced SAQ.

• Payment processing fully outsourced to a validated third partyoptional

  fullyOutsourced

  Enter payment processing fully outsourced to a validated third party.

• E-commerce redirects or iframes to a validated provideroptional

  usesHostedPaymentPage

  Enter e-commerce redirects or iframes to a validated provider.

• Card-present only, standalone terminals, no electronic storageoptional

  standaloneTerminalOnly

  Enter card-present only, standalone terminals, no electronic storage.

• Terminals are IP-connectedoptional

  terminalsIpConnected

  Enter terminals are ip-connected.

• Declared SAQ typeoptional

  declaredSaqType

  What you intend to submit. If the environment does not entitle you to it, we will say so.

Tap to enlarge

Complete the CDE Inventory fields. Each value is validated against the schema before the next step unlocks.

• System Components › Component name (required)

  components.name

  Unique within this inventory — data flows and segments reference it by name.

• System Components › Declared type (required)

  components.declaredType

  How this system relates to the CDE. Declaring it out-of-scope does not make it so — reachability is recomputed.

• System Components › Connects tooptional

  components.connectsTo

  Names of the components this one communicates with, in either direction.

• System Components › Account data stored hereoptional

  components.storesData

  Enter account data stored here.

• System Components › Out-of-scope justificationoptional

  components.justification

  Required when the component is declared out-of-scope.

• System Componentsoptional

  components

  Every system that stores, processes or transmits account data, plus anything connected to one, plus anything that could affect its security.

Tap to enlarge

Complete the Data & Flows fields. Each value is validated against the schema before the next step unlocks.

• Account Data Flows › From component (required)

  dataFlows.from

  Enter from component.

• Account Data Flows › To component (required)

  dataFlows.to

  Enter to component.

• Account Data Flows › Payment channel (required)

  dataFlows.channel

  Enter payment channel.

• Account Data Flows › Encrypted in transitoptional

  dataFlows.encryptedInTransit

  Enter encrypted in transit.

• Account data storedoptional

  dataStorageTypes

  Sensitive authentication data must never be retained after authorization (Requirement 3.3.1).

• Account Data Flowsoptional

  dataFlows

  Enter account data flows.

Tap to enlarge

Complete the Third Parties & Sign-off fields. Each value is validated against the schema before the next step unlocks.

• Third-Party Service Providers › Service provider name (required)

  thirdParties.name

  Enter service provider name.

• Third-Party Service Providers › Service provided (required)

  thirdParties.service

  Enter service provided.

• Third-Party Service Providers › Their AOC is on fileoptional

  thirdParties.aocOnFile

  Enter their aoc is on file.

• Third-Party Service Providers › Their AOC expires (ISO date)optional

  thirdParties.aocExpiryDate

  Enter their aoc expires (iso date).

• Third-Party Service Providers › Requirements they coveroptional

  thirdParties.requirementsCoveredByThem

  Enter requirements they cover.

• Third-Party Service Providers › Requirements we coveroptional

  thirdParties.requirementsCoveredByUs

  Enter requirements we cover.

• Third-Party Service Providers › Risk noteoptional

  thirdParties.riskNote

  Required when no AOC is on file.

• Third-Party Service Providersoptional

  thirdParties

  Enter third-party service providers.

• Scope owner nameoptional

  scopeOwnerName

  Enter scope owner name.

• Scope owner roleoptional

  scopeOwnerRole

  Enter scope owner role.

• Scope owner emailoptional

  scopeOwnerEmail

  Enter scope owner email.

• I confirm this inventory is complete and accurateoptional

  completenessConfirmed

  Enter i confirm this inventory is complete and accurate.

ScreenPCI DSS › Scope·step 6

Complete the Segments fields. Each value is validated against the schema before the next step unlocks.

• Declared Segments › Segment name (required)

  segments.name

  Enter segment name.

• Declared Segments › Segmentation method (required)

  segments.method

  Enter segmentation method.

• Declared Segments › Days since last segmentation testoptional

  segments.lastTestedDaysAgo

  Enter days since last segmentation test.

• Declared Segments › Segmentation test evidence referenceoptional

  segments.testEvidenceRef

  Enter segmentation test evidence reference.

• Declared Segments › Tester was independent of the systems testedoptional

  segments.testerIndependent

  Enter tester was independent of the systems tested.

• Declared Segmentsoptional

  segments

  Segmentation is optional under PCI DSS, and it reduces scope only when it is both implemented and tested. An untested boundary is a claim, not a boundary.

ScreenPCI DSS › Scope·step 7

Complete the Verdicts fields. Each value is validated against the schema before the next step unlocks.

• Total Controls Evaluatedoptional

  totalControlsEvaluated

  Enter total controls evaluated.

• Controls In Placeoptional

  controlsInPlace

  Enter controls in place.

• In Place with Compensating Controloptional

  controlsInPlaceWithCcw

  Enter in place with compensating control.

• Controls Not Applicableoptional

  controlsNotApplicable

  Enter controls not applicable.

• Controls Not In Placeoptional

  controlsNotInPlace

  Enter controls not in place.

• Controls Not Testedoptional

  controlsNotTested

  Enter controls not tested.