PCI DSS network segmentation: everything you need to know (2025)

Would a bank store its cash in every lobby and office, or secure it in a fortified vault?

Your cardholder data environment (CDE) deserves the same treatment. Operating on a flat network—the digital equivalent of leaving cash lying around—is a critical business risk.

It dramatically expands your PCI DSS scope, drives up audit costs, and leaves you open to attacks. More systems in scope means more controls to implement, more data to secure, and potentially six-figure audit bills. Worse, it creates a massive attack surface that increases your risk of a costly breach, not to mention regulatory fines and reputational damage.

That’s where PCI DSS network segmentation becomes your go-to strategy. By isolating your CDE from other networks, you not only reduce your PCI DSS scope but also restrict lateral movement. With 90% of organizations exposed to at least one attack path, isolating your CDE isn’t optional; it’s foundational.

The result: lower audit costs, enhanced security, and improved threat containment.

This guide will cover what network segmentation is, why it's needed, and the best practices for implementing and validating it for PCI DSS 4.0.

What is network segmentation for PCI DSS?

Network segmentation for PCI DSS is the practice of isolating systems that store, process, or transmit cardholder data (CHD) from the rest of your network. Think of it as building a digital vault for your most sensitive data, which allows for more focused and effective protection measures.

The primary goal of PCI DSS network segmentation is simple: prevent unauthorized and potentially malicious traffic from reaching the CDE by isolating it from the rest of your network.

What happens if you skip segmentation and maintain a flat network?

Think of it like a bank with no vault—cash (in this case, cardholder data) is everywhere. Anyone inside can walk right up to it. To protect it, you’d need to secure every inch of the building—guards at every door, cameras in every hallway.

That’s exactly what happens in a flat network. Every system connects to every other system, creating a massive attack surface. If an attacker compromises just one machine, they can move laterally, straight into the CDE.

To make that network PCI compliant? You’d have to secure everything. Every endpoint, every application, every system. It’s possible but costly, complex, and difficult to scale.

Here’s a quick comparison of flat networks and segmented networks to help you decide:

Is network segmentation for PCI DSS mandatory or optional?

Another question that concerns many businesses is whether segmentation is mandatory under PCI DSS 4.0.

The answer: No, it’s not. However, it's the only practical way to minimize the exposure of your systems to the PCI DSS assessment. It’s not an option; it’s an essential strategy for businesses to simplify compliance and reduce audit costs.

On the other hand, it’s noteworthy that PCI DSS network segmentation is not a replacement for an organization-wide security policy and controls. Achieving PCI DSS compliance requires you to complement segmentation with other security measures, including:

• Physical access controls.
• Identity and access management (IAM).
• Multi-factor authentication (MFA).
• Continuous network monitoring.
• Vulnerability scans and penetration testing (pen testing).

The next section throws light on the strategic benefits of segmentation.

Why segmentation matters for PCI compliance

While not explicitly mandated by the standard, PCI DSS network segmentation is a foundational strategy for achieving cost-effective compliance and strong data protection. It directly reduces risk and simplifies the path to a successful audit.

Here’s why PCI DSS network segmentation matters:

1. Dramatically reduces scope and cost

With segmentation, you significantly shrink the number of systems that are subject to the 12 PCI DSS requirements. That means:

• Lower audit fees: A smaller scope means less time and complexity for auditors.
• Reduced internal effort: Your teams spend less time on evidence collection and audit preparation.

This allows you to focus your compliance efforts on a small, controlled environment, which leads to concrete savings.

2. Limits the systems that require PCI controls

With a clearly defined CDE, you can strategically apply rigorous PCI DSS network segmentation controls only where they matter most. Fewer systems under compliance eliminate the need to deploy expensive, enterprise-wide security measures across your entire network.

Validating security controls becomes far more efficient and cost-effective. It allows you to concentrate your budget for advanced security controls, monitoring, and testing on the CDE, leading to significant cost savings related to:

• MFA and IAM.
• Vulnerability scanning tools.
• Pen testing services.

3. Improves your security posture through isolation

Segmentation reduces your attack surface by separating the CDE from the rest of your network. 

If a non-CDE system is compromised—say, an employee's laptop infected with malware—segmentation keeps the threat from spreading laterally.

Instead of turning into a full-blown breach, the incident stays contained. It’s a clear, practical way to reduce impact and meet PCI DSS’s recommended approach to network segmentation.

PCI DSS network segmentation: Key 4.0 updates and their impact

PCI DSS 4.0  provides a more flexible, customizable approach for companies. The new standard expects continuous risk management baked into daily operations—network segmentation included.

Here are the key PCI DSS 4.0 network segmentation updates and what they mean for your business:

The customized approach and its impact

In its landmark version 4.0 update, PCI DSS introduces a new customized approach. This offers greater flexibility in how you implement security controls, including network segmentation for PCI DSS.

This means you can allows you to meet them through alternative controls, provided you can prove equivalence or better.

For instance, traditional segmentation methods, such as firewalls and VLANs, may not be effective when operating on modern network architectures, including:

• Multi-cloud environment.
• Hybrid CDEs.
• Zero-trust architectures.

Modern technologies require modern segmentation solutions, such as micro-segmentation and cloud-native security controls.

Example: In dynamic cloud environments, static IP-based firewalls are impractical. Instead, you can use the customized approach to implement cloud-native controls that use unique digital tags to define the CDE perimeter. Cloud security groups then enforce this policy, permitting traffic only between systems sharing the same CDE tag. This means you effectively segment your network, isolating CDE from non-CDE cloud environments and limiting the blast radius of security incidents.

However, the new PCI version requires you to perform and document a targeted risk analysis for each customized control. You must also be able to prove that it provides equivalent or better segmentation outcomes.

Business impact:

With the customized approach, you can adopt innovative, cost-efficient technologies and alternate security controls without being constrained by outdated security rules. Designing your own segmentation controls provides significantly greater security than the one-size-fits-all approach, thereby minimizing breach risks.

This strategic flexibility, however, comes with a few prerequisites. It requires a mature risk management program, in-house technical expertise, consistent risk monitoring, and rigorous documentation to prove its effectiveness.

New guidance for validating segmentation

Under PCI DSS 4.0, companies have to treat security and compliance as an ongoing discipline, continuously monitoring, testing, and validating all security controls

For segmentation, this means conducting penetration tests to determine if non-CDE systems are truly isolated from the CDE. A failed test indicates the existence of a path from a non-CDE system to a CDE system, which can be exploited by an attacker to breach the CDE.

The new requirements mandate that all segmentation controls must be documented and validated. In addition, version 4.0 requires service providers who have implemented segmentation to validate it by conducting tests:

• At least every six months.
• Or after a significant update or modification to the segmentation.

Business impact:

Continuous validation requires that you include security in any segmentation update from the get-go, not as an afterthought. It strengthens your organization’s security posture by ensuring segmentation gaps are discovered and fixed in time, not months later.

However, it requires dedicated personnel and tools for year-round monitoring and testing, rather than a makeshift, pre-audit effort.

Requirements around documenting segmentation efforts

PCI DSS 4.0 also puts greater emphasis on documenting the segmentation and ongoing validation. Make sure you meticulously document your segmentation strategy, including the scope, justification, technologies used, and how it is maintained and validated.

Auditors will closely examine segmentation documents, including:

• Network and data flow diagrams.
• Asset inventories, including in-scope and out-of-scope systems.
• Network configurations.
• Access control documentation.
• Detailed penetration testing reports.
• Remediation actions and retest outcomes.

Business impact:

While demanding, these requirements force you to have a clear and provable understanding of your segmentation practices. This means you’re in a much stronger position to defend your compliance efforts.

It also requires sustained effort from your compliance and audit teams to systematically maintain a wide range of documents, making it an ongoing practice.

Best practices for PCI DSS network segmentation

The success of your segmentation efforts hinges on how effectively you isolate the CDE from other systems. Miss a gap, and your entire CDE can be exposed to costly breaches, resulting in non-compliance fines, operational sanctions, and reputational damage.

Below are practical, execution-ready steps to build strong, PCI-aligned segmentation:

Isolate the CDE from non-CDE systems

The primary objective of PCI DSS network segmentation is to turn your CDE into a tightly controlled zone, shielded from the rest of your network. Fewer systems in scope means lower audit complexity, reduced cost, and a smaller attack surface.

To do this, apply segmentation controls—like firewalls and cloud-native tools—to enforce a “deny-all” default posture. Only explicitly authorized traffic that supports core business operations should be allowed in.

Any system that can communicate with the CDE—directly or indirectly—must be included in PCI DSS scope and subject to applicable requirements based on its role and risk level.

Use firewalls and access control lists (ACLs) to enforce segmentation boundaries

Strong perimeter controls are your first line of defense. Combine these two technologies to define and enforce your segmentation strategy:

• Firewalls: Firewalls act as a barrier between networks, filtering traffic based on predefined rules and policies. Place them at the network edge, between internal zones and internal and and external networks, to keep all unauthorized and untrusted traffic out of the CDE.
• ACLs: These are sets of rules that allow or deny traffic based on IP addresses and ports. Apply ACLs to routers and switches to control the traffic that moves between different VLANs or subnets.

Firewalls help secure the broader perimeter; ACLs handle precise, internal access. Together, they prevent lateral movement and ensure only trusted systems can interact with the CDE.

Monitor all data flow and access

You can’t protect what you can’t see. Monitoring is non-negotiable, not just for compliance, but for real security.

Continuous monitoring provides critical visibility into all data flows between CDE and non-CDE segments, ensuring segmentation rules are followed and unauthorized access is prevented.

Reactive security is no longer effective. Move beyond intermittent checks to proactively and continuously understand where cardholder data resides, how it flows, and who accesses it.

This involves implementing automation tools to monitor all traffic in and out of the CDE, logging every access detail—who did it, when, and why. Your team needs to regularly review access logs to detect and respond to any anomalies or suspicious activity.

Regularly test and validate your segmentation controls

While isolating and monitoring the CDE are essential, they are not enough.

To ensure your segmentation actually holds, PCI DSS 4.0 requires ongoing validation. This means proactively testing your controls to uncover weaknesses before they become entry points for attackers.

You’ll need to go beyond basic configuration reviews. Focus on two key testing methods:

• Vulnerability scanning: Run scans frequently to identify and fix known security flaws within in-scope systems. This helps you stay ahead of exploitable gaps that could compromise the CDE.
• Pen testing: Simulate real-world attack paths to validate segmentation boundaries. Pen tests reveal if an attacker could move laterally—from a non-CDE system into the CDE—due to overlooked misconfigurations or weak controls.

These tests aren’t just a compliance checkbox. They’re your early warning system. When done right, they confirm that your segmentation is doing what it’s supposed to: keeping sensitive data isolated and protected.

How Scrut simplifies PCI DSS network segmentation

Managing PCI DSS network segmentation manually often turns into a resource drain: disconnected spreadsheets, scattered evidence, and constant back-and-forth during audits. 

But there is a better way: using a compliance automation platform.

Scrut, a leading compliance automation software, can help you run scans and continuously monitor controls more efficiently and quickly.

By automating critical segmentation tasks, Scrut saves time, reduces manual effort, and lowers audit preparation costs. 

From daily control monitoring and automated evidence collection to centralizing all compliance documentation and expert guidance, Scrut is built to simplify end-to-end PCI DSS management.

And Scrut isn’t just designed to get you through a single audit. Its features help embed risk and compliance into daily workflows, making continuous compliance a default state across your business.

Stop letting scope creep complicate your PCI compliance. Book a personalized demo with Scrut to see how you can simplify PCI DSS compliance and move faster—with less effort.