Scope Reduction
Shrinking the set of systems that store, process or transmit cardholder data, because the cost of the standard is proportional to the number of systems in scope.
Every system in the cardholder data environment must meet the full control set, and so must every system that can connect to it. Scope is therefore the primary cost driver, and reducing it is worth more than any efficiency in meeting the controls.
Two techniques do most of the work. Tokenisation at the point of capture — typically a hosted field or an iframe served by the payment provider, so the card number never reaches your systems at all — removes the application from scope entirely for that flow. Network segmentation isolates whatever remains, so connected systems do not inherit scope; the segmentation must be demonstrable, and penetration testing of the boundary is what demonstrates it.
The mistake that expands scope invisibly is a flat network. Without segmentation the entire estate is connected to the cardholder environment and is therefore in scope, which is how an organisation ends up assessing hundreds of systems for a handful of transactions.
The related trap is data that arrives through unintended routes: a card number typed into a support ticket, read over a recorded telephone line, or pasted into a chat transcript. Each brings the receiving system into scope, and none appear on the architecture diagram.