Question

A retail company is deploying a new payment processing application on Google Cloud that must be compliant with PCI DSS. The cardholder data environment (CDE) must be isolated from the rest of the corporate workloads, and the auditors require that the scope of PCI assessment be minimized to only the systems that store, process, or transmit cardholder data. Which design approach BEST reduces PCI DSS audit scope while maintaining strong isolation?

Accepted Answer

Place the cardholder data environment in a dedicated project (or folder) with its own VPC, restricted IAM bindings, and VPC Service Controls perimeter, keeping non-CDE workloads in separate projects.

Answer

Deploy all workloads into a single project and use firewall rules with network tags to separate the CDE from other systems.

Answer

Enable Google-managed default encryption at rest for all resources and document that as sufficient PCI DSS network segmentation.

Answer

Deploy the CDE and corporate workloads in the same VPC but apply Access Context Manager device policies to end users accessing the applications.