Separate and validate payment systems

Editorial update: 21 September 2026. Introductory learning material.

Network segmentation can restrict paths into payment systems and may help limit PCI DSS scope when correctly implemented and validated. A separate VLAN or subnet alone does not prove effective isolation.

• Map authorized connections and administration paths.
• Restrict access to necessary users and services.
• Document dependencies on shared infrastructure.
• Have qualified personnel test the boundaries and review changes.
• Confirm the assessment requirements with the responsible payment-compliance parties.

Segmentation reduces certain risks; it does not guarantee that a payment system remains safe if another system is compromised.

Activity: Ask your technical owner to explain and demonstrate the boundary using an approved test plan.

Reference: PCI SSC guidance on segmentation and assessment scope. Check the source and your system provider’s current instructions before implementation.