Topic starter
10/07/2026 9:10 pm
TL;DR: PCI DSS 4.0 does not require network segmentation, but it makes segmentation the practical mechanism for shrinking cardholder data environment scope, and once used it must be documented, justified, and penetration-tested under Requirements 1.2.6 and 11.4.1, according to Elisity. Scope control, not mandatory design, is the real compliance decision, because boundary choices determine assessment cost, testing burden, and residual risk.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “PCI DSS 4.0 Network Segmentation Requirements Explained”.
Key questions
Q: What fails when PCI DSS 4.0 segmentation is not proven in testing?
A: The scope claim fails first.
Q: Why does segmentation matter so much for PCI DSS compliance cost?
A: Because scope drives the size of the assessment.
Q: What are the signs that a PCI segmentation model is too weak?
A: The clearest signs are broad trust zones, unmanaged management-plane access, too many exceptions across the boundary, and difficulty proving that out-of-scope systems cannot reach the CDE.
Practitioner guidance
- Document the CDE boundary as an evidence set Record which systems are in scope, which are out of scope, and exactly why each out-of-scope claim is valid.
- Inventory every allowed path across the boundary Create a justified allowlist for services, protocols, ports, and management routes that cross into the CDE.
- Test the boundary as an attacker would Use penetration testing to validate that an out-of-scope system cannot reach CDE assets.
Bottom line: PCI DSS 4.0 does not force segmentation, but it does force organisations to prove what their segmentation claim actually removes from scope.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:33 pm
Segmentation is a governance boundary, not a wiring diagram. PCI DSS 4.0 makes that distinction unavoidable because scope is determined by what can still influence the CDE, not by how tidy the network looks on paper. That means compliance teams must think in terms of access paths, not just subnets and VLANs. The practitioner conclusion is straightforward: if influence remains, scope remains.
A question worth separating out:
Q: Should compliance teams treat network segmentation as a security control or a scoping control?
A: Both, but scoping is the more important lens in PCI DSS 4.0. The control matters because it reduces exposure, yet the standard cares most about whether the boundary truly removes systems from scope. Teams should govern it as an evidence-backed scope boundary with security side effects.
👉 Read our full editorial: PCI DSS 4.0 segmentation is about scope control, not mandatory design