A commerce platform wants to reduce the systems in scope for payment card compliance. What architecture achieves that?
Show the full answer Hide the answer
The governing principle
Scope follows the data. Any system that stores, processes or transmits card data is in scope, along with any system that can affect the security of those systems. Reducing scope means reducing where card data goes — not adding controls to more places.
The mechanisms, in order of effect
- Never receive the data. Payment fields hosted by the payment provider — an iframe or a redirect — mean card data goes from the browser to the provider without touching the platform. This is the single largest reduction available and it removes entire systems from scope rather than securing them.
- Tokenise at the boundary. Where the platform must receive the data, exchange it for a token immediately so that everything downstream holds a token that has no mathematical relationship to the card number.
- Network segmentation. Systems handling card data isolated so that the rest of the estate cannot affect their security — without segmentation, the flat network puts everything in scope.
- Point-to-point encryption for physical terminals, so the merchant environment never holds readable data.
What is easy to miss
Systems that can affect the security of in-scope systems are in scope. That includes the identity provider, the deployment pipeline, the monitoring platform, the DNS configuration and the jump hosts. Teams routinely scope the payment service correctly and omit the pipeline that deploys it.
And logs. A card number in an application log or an error report puts the logging platform in scope, which is expensive and usually accidental. Redaction at the logging library, not at the log aggregator, is what prevents it.
The strategic framing
Compliance cost scales with scope, so scope reduction is the highest-return security investment available here — it reduces the audit surface, the control burden and the breach exposure simultaneously, which is rare enough to be worth stating explicitly when justifying the work.