Question

A retail organization processes credit card payments through an in-house web application that stores full cardholder data in its database. During a PCI DSS assessment, the QSA notes the entire corporate network is currently in scope because the payment application shares network segments with general business systems. The CISO wants to reduce the cost and complexity of maintaining compliance for the next assessment cycle. Which approach would MOST effectively reduce the PCI DSS scope while maintaining the ability to accept card payments?

Accepted Answer

Implement network segmentation to isolate the cardholder data environment and outsource payment processing to a PCI-validated third-party provider using tokenization

Answer

Encrypt the cardholder data at rest in the existing database and document the encryption keys in the corporate change management system

Answer

Increase the frequency of internal vulnerability scans across all corporate network segments to demonstrate continuous monitoring

Answer

Require all employees to complete annual PCI DSS awareness training and sign an acceptable use policy acknowledgment