Govern & Assure
PCI DSS Scoping
PCI DSS scoping to establish what is actually in scope, where the cardholder data environment starts and stops, and where legitimate scope reduction may be possible.
- A clear view of the payment environment
- Defined scope boundaries
- Scope reduction opportunities
- Better understanding of what applies
- A practical next step
Scope is one of the biggest drivers of PCI DSS cost, complexity, and ongoing effort. If payment channels, data flows, systems, and third parties are not understood properly, you can end up assessing more than you need to, missing important dependencies, or building a compliance programme around the wrong assumptions.
We start with how card payments actually work in your organisation. That means looking at the payment channels, the systems involved, where account data is stored, processed, or transmitted, which third parties support the environment, and where the boundaries sit between in-scope and out-of-scope systems.
From there, we identify the likely cardholder data environment, the PCI DSS requirements that may apply, and any practical opportunities to reduce scope or simplify the environment. In some cases, good design decisions can move an organisation from needing to consider most of the PCI DSS requirement set to a much smaller subset. That can reduce assessment effort, ongoing compliance cost, and the amount of technology exposed to cardholder-data risk.
You leave with a clearer, defensible view of scope before you invest time and money assessing controls or remediating things that may not need to be in the programme at all.
Get a quote for PCI DSS Scoping
Tell us your scope and objectives, and we’ll come back with a clear, fixed proposal, usually the same working day.
Get a Quoteor call +44 (0) 203 393 7795- CREST-accredited
- UK-based specialists
- Crown Commercial Service supplier
How it works
- 01
Understand the organisation and payment channels
We start with your organisational structure, how payments are accepted, and the systems, suppliers, and locations involved.
- 02
Map data flows and supporting technology
We work through where account data is stored, processed, or transmitted and identify the systems and third parties that support those flows.
- 03
Identify the cardholder data environment
We establish the likely CDE for each in-scope payment channel and identify relevant boundaries with systems or networks outside it.
- 04
Review scope reduction opportunities
We look for practical ways to reduce unnecessary scope, such as changes to payment architecture, segmentation, or use of third-party services.
- 05
Confirm what needs attention
We map the identified environment to the relevant PCI DSS requirements and highlight where further assessment or remediation may be needed.
- 06
Report and recommend next steps
We provide a summary of the scope identified, key observations, and recommendations for the next stage of the compliance programme.
PCI DSS support for service providers
We also work directly with service providers that need to understand or validate their own PCI DSS obligations. That can include scoping the services and systems that are relevant to PCI DSS, identifying which requirements apply, carrying out gap and readiness assessments, supporting remediation, and completing formal QSA assessment where required.
Service provider scope can be more complex because responsibilities may be shared across platforms, customers, and supporting technologies. We help make those boundaries clear so you know what needs to be assessed, what evidence is required, and where responsibilities sit between you and your customers.
What you get
A clear view of the payment environment
We map the payment channels, systems, data flows, and supporting third parties that matter to PCI DSS.
Defined scope boundaries
We establish where the cardholder data environment begins and ends, including relevant connections to out-of-scope systems.
Scope reduction opportunities
Where the architecture and payment model allow, we find legitimate ways to reduce scope, which can lower cost, overhead, and cardholder-data risk.
Better understanding of what applies
We show which PCI DSS requirements are likely to apply to each payment environment, based on the scope identified.
A practical next step
You finish with clear recommendations on the next step: a gap assessment, remediation work, formal assessment, or further scoping.
QSA judgement from the start
A QSA carries out the work, so the scope is considered in the context of how PCI DSS assessment and validation actually work.
Frequently asked questions
Straight answers to what prospective clients ask us most.
Why is PCI DSS scoping so important?
Because scope determines what needs to be assessed and where compliance effort is spent. If scope is too broad, the programme becomes more expensive and complicated than necessary. If it is too narrow, important systems or dependencies can be missed.
Can you help us reduce PCI DSS scope?
Yes, where the environment allows it. We look for legitimate ways to simplify the cardholder data environment or reduce the systems and requirements that need to be assessed, without creating additional risk.
What information will you need from us?
Typically, access to people who understand payment processes and supporting technology, plus relevant architecture diagrams, payment-flow information, supplier details, and existing PCI DSS documentation where available. We agree the exact inputs at the start of the engagement.
Does a scoping assessment tell us whether we are compliant?
No. Scoping establishes what is in scope and what needs to be assessed. It may identify obvious issues or likely gaps, but it is not a substitute for a gap assessment or formal PCI DSS assessment.
Will you tell us which SAQ or reporting route applies?
We will give you our view of the likely route based on the environment and scope, but merchant reporting requirements are ultimately driven by the organisation managing your compliance programme, such as your acquirer or payment brand. A clear scope means that decision can be made on the right basis.
What happens after the scoping assessment?
That depends on what the work identifies. The next step may be a gap assessment, remediation activity, further technical investigation, a design change to reduce scope, or formal assessment if the environment is ready.
Can we outsource all of our PCI DSS responsibilities?
No. Third-party providers can take on significant parts of the payment process and materially reduce your PCI DSS scope, but they do not remove your responsibilities altogether. You still need to understand which providers are involved, what services they perform, what responsibilities remain with you, and whether their own PCI DSS compliance supports the services you rely on.
Related services
Ready to talk about pci dss scoping?
Get a fixed-scope quote, usually the same working day.