Your first PCI assessment finds the whole estate in scope. How did that happen and how do you reduce it?

What the interviewer is testing

Whether you understand that scope is determined by connectivity as well as by data, and that it is the main determinant of compliance cost.

How it happened

A flat network. PCI applies to every system that stores, processes or transmits cardholder data and every system connected to those. On an unsegmented network, everything is connected to everything, so everything is in scope — and each in-scope system needs the full control set, evidence and annual assessment.

This is the default state, and it is what most organisations discover at their first assessment.

Reducing it

Network segmentation so the cardholder data environment is genuinely isolated, with minimal, documented, demonstrable connectivity. Segmentation must be tested — an assessor will want evidence that the boundary holds, not a diagram.

Tokenise at the earliest possible point. Once the card number is replaced by a token, downstream systems handling tokens generally fall out of scope. Tokenising at the edge can shrink the audited estate from hundreds of systems to a handful, which is usually the business case.

Hosted payment fields or redirect, where the card number goes directly from the customer's browser to the payment provider and never touches your servers. This is what reduces a merchant from the most demanding validation level to the simplest, and it is the single largest scope reduction available.

What pulls systems back in unexpectedly

Card numbers in application logs. In a support ticket where a customer pasted one. In a database backup. In an analytics event. In a screenshot attached to a bug report.

Each of these pulls the receiving system fully into scope, and preventing them is a detection problem as much as a design one — pattern-based scanning of logs and tickets, plus input handling that never logs payment fields.

What a strong answer adds

The economic framing for the business: scope is the largest single driver of compliance cost, so tokenisation and hosted fields are not security refinements, they are the difference between a manageable annual assessment and a permanent programme. That framing gets the work funded.

Common weak answers

Applying controls estate-wide, which is enormously expensive and unnecessary. Assuming the payment provider's compliance covers you.