Lab 01 — Build PCI Scope

Mission Information

Item	Details
Lab	01 — Build PCI Scope
Module	PCI DSS v4.x
Difficulty	Intermediate
Estimated Time	90–120 Minutes
Primary Role	PCI GRC Analyst
Supporting Roles	Security Architect, Network Engineer, Cloud Engineer, Payment Team, IAM, Third-Party Risk
Primary Objective	Define and document a defensible PCI DSS scope
Primary Output	PCI Scope Package

Mission Scenario

You have joined CloudShop, a fictional e-commerce company that accepts card payments through its public website.

Management is preparing for its next PCI DSS assessment.

The organization believes that only the payment database is in PCI scope.

Your initial architecture review suggests the environment is more complex.

CloudShop uses:

Public E-Commerce Website

Payment Application

Payment Database

External Payment Gateway

AWS Cloud Infrastructure

Central Identity Provider

Administrative Jump Host

CI/CD Platform

Central SIEM

Vulnerability Scanner

Corporate Network

Developer Network

Management currently states:

Only the payment database
is in PCI scope.

Your mission is to determine whether this statement is accurate.

Mission Objective

You must build a complete PCI scoping package that answers:

Where does payment data enter?

Where does cardholder data travel?

Where is cardholder data stored?

Which systems process or transmit it?

Which systems can connect to the CDE?

Which systems can affect CDE security?

Which third parties are involved?

Which systems can legitimately be excluded?

Is segmentation sufficient?

What is the final PCI scope?

What You Will Build

By the end of the lab, you will create:

01 Payment Channel Register

02 Account Data Inventory

03 Cardholder Data Flow

04 CDE Asset Inventory

05 PCI System Classification Matrix

06 Administrative Access Flow

07 Third-Party Service Provider Register

08 PCI Responsibility Matrix

09 Scope Exclusion Register

10 PCI Scope Gap Register

11 Final PCI Scope Statement

Environment Architecture

Use the following fictional CloudShop architecture.

                         Internet
                            │
                            ▼
                    ┌──────────────┐
                    │ CloudShop Web │
                    └──────┬───────┘
                           │
                           ▼
                    ┌──────────────┐
                    │ Payment API   │
                    └──────┬───────┘
                           │
                ┌──────────┴──────────┐
                ▼                     ▼
        ┌──────────────┐       ┌──────────────┐
        │ Payment DB    │       │ Payment      │
        │ Encrypted PAN │       │ Gateway      │
        └──────────────┘       └──────────────┘
                                      │
                                      ▼
                              Payment Processor

Supporting systems:

Enterprise Identity Provider
          │
          ▼
      Jump Host
          │
          ▼
         CDE


Developer
   │
   ▼
Git Repository
   │
   ▼
CI/CD Platform
   │
   ▼
Payment Application


CDE Systems
   │
   ├──→ Central SIEM
   │
   ├──→ Vulnerability Scanner
   │
   └──→ Backup Platform

Network architecture:

Corporate Network
       │
       │
       ▼
Segmentation Firewall
       │
       ▼
     CDE VPC


Developer Network
       │
       └────────→ CDE VPC
                  TCP/443 Allowed

Step 1 — Identify Payment Channels

Start by identifying every channel through which CloudShop accepts card payments.

For this lab:

E-Commerce Website

is the primary payment channel.

Create:

01 Payment Channel Register

Use:

Channel	Entry Point	Payment Method	Provider	Owner
E-Commerce	CloudShop Checkout	Payment Card	External Gateway	Digital Commerce

Analyst Question

Ask:

Could customers submit cardholder data through any other channel?

Consider:

Support Tickets

Telephone

Email

Mobile App

Manual Refunds

For the initial lab assume:

No additional approved payment channels

but record that this must be validated with business owners.

Step 2 — Identify Account Data

CloudShop payment transactions use:

PAN

Cardholder Name

Expiration Date

CVV

Create:

02 Account Data Inventory

Use:

Data Element	Stored	Processed	Transmitted	Location
PAN	Yes	Yes	Yes	Payment DB / Application
Cardholder Name	Yes	Yes	Yes	Payment DB
Expiration Date	Yes	Yes	Yes	Payment DB
CVV	No after authorization	Yes	Yes	Payment Flow Only

Analyst Observation

CVV is:

Sensitive Authentication Data

CloudShop should not retain it after authorization.

Required Validation

Verify that CVV is not stored in:

Database

Logs

Support Systems

Application Debug Files

Backups

Step 3 — Trace the Cardholder Data Flow

Create:

03 Cardholder Data Flow

Document:

Customer Browser
      ↓
CloudShop Website
      ↓
Payment API
      ↓
Payment Gateway
      ↓
Payment Processor

Additional storage path:

Payment API
      ↓
Payment Database
      ↓
Encrypted PAN

Data Flow Register

Use:

Source	Destination	Data	Protocol	Purpose
Browser	Website	CHD	HTTPS	Checkout
Website	Payment API	CHD	HTTPS	Payment Processing
Payment API	Payment Gateway	CHD	HTTPS	Authorization
Payment API	Payment DB	PAN / Transaction Data	TLS	Storage

Step 4 — Identify Direct CDE Systems

Identify systems that:

Store CHD

Process CHD

Transmit CHD

Classify:

CloudShop Website

Processes or transmits payment information.

Classification:

CDE

Payment API

Processes and transmits CHD.

Classification:

CDE

Payment Database

Stores PAN.

Classification:

CDE

Create:

04 CDE Asset Inventory

Use:

Asset	Function	Stores CHD	Processes CHD	Transmits CHD	Owner
WEB-PAY-01	Checkout	No	Yes	Yes	Engineering
API-PAY-01	Payment API	No	Yes	Yes	Engineering
DB-PAY-01	Payment DB	Yes	Yes	No	Database Team

Step 5 — Identify Connected Systems

Now identify systems that do not directly handle PAN but can access CDE systems.

Jump Host

Architecture:

Administrator
      ↓
Jump Host
      ↓
CDE

Classification:

Connected-to / Security-Impacting

Reason:

Provides administrative access
to CDE systems

Step 6 — Identify Security-Impacting Systems

Review systems that provide security or management services to the CDE.

Identity Provider

CDE administrators authenticate through the enterprise identity platform.

Classification:

Security-Impacting

Reason:

Controls CDE authentication
and privileged access

Central SIEM

Receives CDE security logs.

Classification:

Security-Impacting

Reason:

Supports PCI logging
and monitoring controls

Vulnerability Scanner

Scans CDE systems.

Classification:

Security-Impacting

Reason:

Supports PCI vulnerability
management

Backup Platform

Stores backups of the payment database containing encrypted PAN.

Classification:

CDE

or directly PCI-relevant because:

Stores CHD

Step 7 — Analyze CI/CD

CloudShop developers use:

Git Repository
      ↓
CI/CD
      ↓
Payment Application

Ask:

Can CI/CD deploy code
to production payment systems?

Answer:

Yes

Therefore:

CI/CD Platform
→ Security-Impacting

Reason:

Can modify CDE applications

Step 8 — Analyze Source Repository

Ask:

Can repository changes
reach production?

Yes.

Classification:

Security-Impacting

because compromise could lead to:

Malicious Code
      ↓
CI/CD
      ↓
Payment Application

Step 9 — Build PCI System Classification Matrix

Create:

05 PCI System Classification Matrix

Use:

System	Classification	Reason
Payment Website	CDE	Processes / transmits CHD
Payment API	CDE	Processes / transmits CHD
Payment DB	CDE	Stores PAN
Backup Platform	CDE	Stores backup containing PAN
Jump Host	Connected-to	Administrative CDE access
Identity Provider	Security-Impacting	Authenticates CDE admins
SIEM	Security-Impacting	Provides CDE monitoring
Vulnerability Scanner	Security-Impacting	Scans CDE
CI/CD	Security-Impacting	Can modify payment application
Git Repository	Security-Impacting	Source for production payment code
Segmentation Firewall	Segmentation	Enforces CDE boundary
Corporate Network	Potentially Out of Scope	Subject to segmentation validation
Developer Network	Requires Investigation	Has CDE connectivity

Step 10 — Map Administrative Access

Create:

06 Administrative Access Flow

Use:

Administrator
      ↓
Enterprise Identity Provider
      ↓
MFA
      ↓
Jump Host
      ↓
Payment Systems

Document:

Component	Purpose	PCI Relevance
Identity Provider	Authentication	Security-Impacting
MFA	Strong Authentication	PCI Control
Jump Host	Admin Gateway	Connected-to
Payment Systems	Target	CDE

Step 11 — Investigate Developer Network Connectivity

Architecture shows:

Developer Network
      ↓
CDE
TCP/443

This is a critical scoping question.

Ask:

Why does Developer Network
need direct CDE connectivity?

Possible answer:

Developers test production APIs
directly.

This creates risk.

Current Classification

Developer Network
→ Connected-to

unless connectivity is removed or appropriately isolated.

Step 12 — Assess Scope Reduction

Management wants the Developer Network excluded from scope.

To support exclusion:

Developer Network
      ✗
      ↓
CDE

should normally be enforced.

Recommended architecture:

Developer Network
      ↓
CI/CD
      ↓
Controlled Deployment
      ↓
CDE

without direct developer-network access.

Step 13 — Test Segmentation Assumptions

Create test:

Developer Workstation
      →
Payment API
443

Expected if Developer Network is out of scope:

Blocked

Current architecture:

Allowed

Result:

Segmentation / Scope Issue

Step 14 — Identify Third-Party Providers

CloudShop uses:

Cloud Provider

Payment Gateway

Payment Processor

Create:

07 Third-Party Service Provider Register

Use:

Provider	Service	CHD Role	PCI Impact	Assurance
Cloud Provider	Infrastructure	Hosts CDE	High	Review PCI AOC
Payment Gateway	Payment Processing	Receives CHD	Critical	Review PCI AOC
Payment Processor	Authorization	Processes CHD	Critical	Review PCI Assurance

Step 15 — Review Provider Assurance

For each provider obtain, where appropriate:

Current PCI AOC

Service Scope

Responsibility Matrix

Relevant Service Description

Do not conclude:

Provider Is PCI Compliant
      ↓
CloudShop Is PCI Compliant

Step 16 — Build PCI Responsibility Matrix

Create:

08 PCI Responsibility Matrix

Example:

Control Area	CloudShop	Cloud Provider	Payment Provider
Physical Data Center	—	✓	Provider
Payment Application	✓	—	—
Cloud IAM	✓	Shared	—
Network Security	✓	Shared	—
PAN Processing	✓	—	✓
Payment Authorization	—	—	✓
Logging	✓	Shared	Provider Controls

Step 17 — Identify Potentially Out-of-Scope Systems

Review:

HR SaaS

Marketing Platform

Learning Platform

Corporate Collaboration

Assume they:

Do Not Store CHD

Do Not Connect to CDE

Do Not Affect CDE Security

They may be considered potentially out of scope.

Step 18 — Build Scope Exclusion Register

Create:

09 Scope Exclusion Register

Use:

System	Exclusion Reason	Validation Evidence	Status
HR SaaS	No CHD / no CDE connectivity	Architecture Review	Excluded
Marketing SaaS	No CHD / no security dependency	Data Flow Review	Excluded
Collaboration Platform	No CDE connectivity	Network Review	Excluded

Step 19 — Do Not Exclude Systems by Department

Weak reasoning:

HR System
→ HR Department
→ Out of PCI Scope

Correct reasoning:

No CHD

No CDE Connectivity

No CDE Security Impact
      ↓
Potentially Out of Scope

Step 20 — Review Logging for Unexpected CHD

Assume application logs contain:

payment_request
PAN=4111111111111111

This creates:

Central SIEM
      ↓
Stores PAN

If true, SIEM may move from merely:

Security-Impacting

to directly handling CHD.

Required Action

Stop PAN Logging

Assess Existing Logs

Remove / Protect Stored PAN

Update Scope

Step 21 — Review Support Systems

Interview Customer Support.

Question:

Do customers ever submit card numbers through support tickets?

Suppose answer:

Sometimes

This introduces:

Support Platform
→ Potential CHD Storage

The platform must be investigated.

Step 22 — Build PCI Scope Gap Register

Create:

10 PCI Scope Gap Register

Use:

Gap	Risk	Scope Impact	Owner	Action
Developer Network reaches CDE	High	Scope Expansion	Network	Remove access
PAN in application logs	High	SIEM may enter CDE	Engineering	Redact PAN
Support tickets may contain PAN	High	SaaS scope expansion	Support	Investigate / prevent
Backup omitted from CDE	High	Incomplete scope	Infrastructure	Add to scope
CI/CD omitted	High	Security-impacting system missed	DevOps	Add classification

Step 23 — Analyze Original Management Claim

Original statement:

Only Payment Database
Is in PCI Scope

Your analysis demonstrates:

Incorrect

At minimum, CloudShop’s relevant environment includes:

Payment Website

Payment API

Payment Database

Backup Platform

Jump Host

Identity Provider

CI/CD

Source Repository

SIEM

Vulnerability Scanner

Segmentation Controls

Relevant Cloud Infrastructure

Relevant Third Parties

with Developer Network status dependent on remediation and segmentation validation.

Step 24 — Build Current-State Scope

Current state:

                PCI Relevant Environment

                    Payment Website
                          │
                          ▼
                      Payment API
                     /           \
                    ▼             ▼
             Payment DB      Payment Gateway
                 │
                 ▼
              Backup


Identity Provider
      ↓
Jump Host
      ↓
CDE


Repository
      ↓
CI/CD
      ↓
CDE


Scanner ─────→ CDE
SIEM ←──────── CDE


Developer Network
      ↓
      CDE
      ⚠

Step 25 — Build Target-State Architecture

Recommended:

Developer Network
      ✗
      ↓
CDE

Developer
      ↓
Repository
      ↓
CI/CD
      ↓
Approved Deployment
      ↓
CDE

Administrative path:

Administrator
      ↓
MFA
      ↓
Jump Host
      ↓
CDE

Step 26 — Scope Reduction Recommendations

Recommend:

Remove direct Developer-to-CDE connectivity

Prevent PAN from entering logs

Prevent PAN in support systems

Use hosted/tokenized payment flows where practical

Maintain dedicated CDE network

Use controlled administrative paths

Continuously validate segmentation

Step 27 — Build Final PCI Scope Statement

Create:

11 Final PCI Scope Statement

Use the following model.

PCI Scope Statement

CloudShop’s PCI DSS scope includes the people, processes, technologies, and third-party services supporting its e-commerce payment environment.

The direct Cardholder Data Environment includes:

Payment Website

Payment API

Payment Database

Payment Database Backup

The following systems are included because they connect to or can affect the security of the CDE:

Administrative Jump Host

Enterprise Identity Provider

CI/CD Platform

Source Code Repository

Central Security Monitoring Platform

Vulnerability Scanning Platform

Network Segmentation Controls

Relevant Cloud Management and Network Services

Third-party dependencies include:

Cloud Infrastructure Provider

Payment Gateway

Payment Processor

The Developer Network currently has direct connectivity to the CDE and therefore cannot be treated as fully isolated from PCI scope until that connectivity is removed or otherwise justified and technically validated.

Systems may be excluded only where CloudShop can demonstrate that they:

Do Not Store CHD

Do Not Process CHD

Do Not Transmit CHD

Cannot Connect to CDE

Cannot Affect CDE Security

Step 28 — Scope Validation Evidence

Your final scope decision should be supported by:

Payment Channel Register

Account Data Inventory

Cardholder Data Flow

Network Diagram

CDE Asset Inventory

System Classification Matrix

Administrative Access Diagram

Firewall Rules

Segmentation Testing

Provider Assurance

Interviews

Technical Discovery

Step 29 — Management Summary

Prepare a short executive finding:

CloudShop’s current assumption that only the payment database is within PCI DSS scope is not supportable. The payment application, supporting security and administrative platforms, backup infrastructure, deployment systems, network segmentation controls, and relevant service providers all contribute to the PCI environment. Direct Developer Network connectivity and potential PAN exposure in logs and support systems require remediation before the organization can establish a defensible reduced PCI scope.

Step 30 — Scope Decision Matrix

Use:

Component	Decision
Payment Website	In Scope
Payment API	In Scope
Payment DB	In Scope
Payment Backup	In Scope
Jump Host	In Scope / Connected-to
Identity Provider	Security-Impacting
SIEM	Security-Impacting
Vulnerability Scanner	Security-Impacting
CI/CD	Security-Impacting
Source Repository	Security-Impacting
Segmentation Firewall	In Scope
Developer Network	Scope Concern / Connected-to
Corporate Network	Potentially Out of Scope after validation
Payment Gateway	Third-Party PCI Dependency
Cloud Provider	Third-Party PCI Dependency

Lab Deliverables Checklist

Before completing the lab, confirm you created:

• 01 Payment Channel Register

• 02 Account Data Inventory

• 03 Cardholder Data Flow

• 04 CDE Asset Inventory

• 05 PCI System Classification Matrix

• 06 Administrative Access Flow

• 07 Third-Party Service Provider Register

• 08 PCI Responsibility Matrix

• 09 Scope Exclusion Register

• 10 PCI Scope Gap Register

• 11 Final PCI Scope Statement

Validation Checklist

Payment Channels

• All payment channels identified.

• CHD entry points identified.

• payment owners identified.

Data

• PAN flow identified.

• PAN storage identified.

• SAD handling reviewed.

• logs reviewed for CHD.

• support workflows reviewed for CHD.

CDE

• storing systems identified.

• processing systems identified.

• transmitting systems identified.

• backups identified.

Security Dependencies

• identity platform reviewed.

• administrative paths reviewed.

• CI/CD reviewed.

• repository reviewed.

• logging reviewed.

• vulnerability scanning reviewed.

Network

• CDE boundary defined.

• Developer Network connectivity reviewed.

• Corporate Network connectivity reviewed.

• segmentation firewall reviewed.

• segmentation validation planned.

Third Parties

• cloud provider identified.

• payment gateway identified.

• payment processor identified.

• PCI assurance identified.

• responsibilities mapped.

Exclusions

• exclusion reasons documented.

• no CHD validated.

• no connectivity validated.

• no security dependency validated.

Challenge 1 — Unexpected Backup

During the assessment you discover:

DB-PAY-01
      ↓
Nightly Backup
      ↓
S3 Bucket

The bucket contains encrypted PAN.

Question:

Is the bucket relevant to PCI scope?

Answer:

Yes

because it stores cardholder data.

Challenge 2 — SIEM Contains PAN

You discover the application logs:

Full PAN

into the SIEM.

Question:

Does this affect PCI scope?

Answer:

Yes

The SIEM is now not only security-impacting; it is also storing CHD until the issue is remediated and data handling is reassessed.

Challenge 3 — Developer Connectivity

Developer workstation can access:

Payment API
443

Question:

Can the Developer Network automatically be considered out of scope?

Answer:

No

The connectivity must be analyzed, restricted, or otherwise treated appropriately in scope.

Challenge 4 — Cloud Provider

Cloud provider has a current PCI AOC.

Question:

Does that make CloudShop PCI compliant?

Answer:

No

CloudShop remains responsible for its own:

IAM

Network Configuration

Applications

Data Handling

Logging

Security Testing

Challenge 5 — Tokenization

CloudShop redesigns so that:

Customer
      ↓
Payment Provider
      ↓
Token
      ↓
CloudShop

Question:

Could this reduce PCI scope?

Answer:

Potentially Yes

but the new architecture, tokenization model, merchant responsibilities, and provider responsibilities must be validated.

Lab Success Criteria

The lab is complete when you can confidently answer:

Where does CHD enter?

Where does CHD travel?

Where is CHD stored?

Which systems form the CDE?

Which systems connect to the CDE?

Which systems protect the CDE?

Which platforms can modify the CDE?

Which providers handle payment data?

Which networks can reach the CDE?

Which systems can be excluded?

What evidence supports every scope decision?

Professional Deliverable

Your final PCI scope package should contain:

Executive Summary

Payment Channel Register

Account Data Inventory

CHD Flow Diagram

CDE Asset Inventory

System Classification Matrix

Administrative Access Flow

Third-Party Register

Responsibility Matrix

Scope Exclusion Register

Scope Gap Register

Final PCI Scope Statement

Remediation Recommendations

This package should be suitable for review by:

PCI Program Owner

CISO

Security Architecture

Network Security

Payment Engineering

GRC

QSA / PCI Assessor

Lab Completion

You have now completed:

Lab 01 — Build PCI Scope

You moved from:

Management Assumption

to:

Payment Data Discovery
      ↓
Architecture Analysis
      ↓
System Classification
      ↓
Third-Party Mapping
      ↓
Scope Validation
      ↓
Defensible PCI Scope

The key lesson from this lab is:

PCI scope is determined by payment-data flow, connectivity, administrative capability, and security dependencies—not by system names, departments, or assumptions.

What’s Next?

➡️ Next: Lab 02 — PCI Gap Assessment

In the next lab, you will use the CloudShop PCI scope created here and perform a structured assessment across key PCI control areas.

You will investigate deliberate control weaknesses involving:

Network Segmentation

Access Control

MFA

Vulnerability Management

Logging

Secure Development

Penetration Testing

Third-Party Assurance

and build:

PCI Requirement Assessment Matrix
      ↓
Control Evidence Review
      ↓
Gap Register
      ↓
Risk Rating
      ↓
Root Cause Analysis
      ↓
Remediation Plan
      ↓
PCI Readiness Conclusion