Systems that store, process or transmit payment card data are spread across a flat internal network, so the payment card industry standard applies to nearly every system. What is the MOST effective way to reduce the compliance effort?
Select an answer to reveal the explanation.
Short Explanation
If the whole house counts as the vault, you've got to guard every room. Network segmentation shrinks the vault to one room, so the payment card rules only apply there, and that's the cheapest way to make your compliance job smaller.
Full Explanation
When cardholder data flows across a flat network, every connected system can affect its security, so the payment card standard's requirements extend across the environment. Network segmentation isolates the systems that store, process or transmit cardholder data from the rest of the network, which can reduce the number of systems in scope for assessment and control, lowering cost and complexity while concentrating protection where the data resides. Segmentation must be effective and validated for the scope reduction to hold. Applying the full requirements to every system is a way to comply but not a way to reduce effort, which is the stated objective; it spends heavily on systems that need not handle card data. Cyber insurance may offset some financial consequences of a breach, but it transfers financial impact only, does not reduce scope and does not satisfy compliance obligations. Asking the acquiring bank to waive requirements is not a realistic control strategy; compliance obligations flow through card brand and acquirer agreements, and a waiver for all internal systems would not be a sound basis for a program. Exam caveat: reducing where card data is stored, for example through tokenization, is another way to reduce scope. Operational check: confirm a current data flow diagram identifies all card data locations and that segmentation is tested to show isolation.