Day 10 of 22PCI DSS· ~60 min

Scope a PCI DSS assessment — identify the CDE

Scenario

SwiftLend has just launched a co-branded credit-card product. Customers apply through the SwiftLend app; card manufacturing is by a bank partner; but SwiftLend processes ~500,000 card transactions per year for card top-ups and repayments. Card data touches these systems: 1. Mobile app (card details entered via web-view iframe from Razorpay) 2. SwiftLend Payment Gateway integration (uses Razorpay APIs — API token stored in AWS Secrets Manager) 3. Backend transaction logs (Postgres — stores masked PAN + last 4 digits) 4. Fraud-detection service (Python, receives transaction metadata but no full PAN) 5. Support ticketing (Freshdesk — customers sometimes paste full card numbers in tickets, currently no scrubbing) 6. Backup system (encrypts + copies Postgres nightly to a separate AWS account)

Your role

You are the PCI DSS Lead.

Your task

Produce the CDE (Cardholder Data Environment) diagram + written scope statement: 1. For each of the 6 systems: In-CDE / Connected-to-CDE / Out-of-scope — with justification 2. Segmentation strategy (what needs isolation) 3. Merchant level (based on transaction volume) 4. Applicable SAQ type or full ROC 5. TWO scope-reduction options with cost/effort tradeoff

Deliverable format: Written scope document ~600 words + a simple diagram (ASCII or Mermaid)

Toolkit

  • PCI DSS v4.0 CDE definition: any system that stores, processes, transmits, or is connected to CHD
  • Iframe from Razorpay = PAN never touches your servers = SAQ A eligibility
  • 500K trans/year — Level 2 or Level 3 merchant (check exact bank thresholds)
  • Freshdesk PAN paste = huge scope violation, needs immediate DLP or PII scrubber

Success criteria (what the AI grades against)

  • Freshdesk correctly flagged as CDE-touching due to PAN paste — needs remediation
  • Backup system is IN scope (holds encrypted PAN)
  • Fraud-detection service correctly assessed (metadata only = probably out of scope)
  • SAQ A recommended IF tokenisation + iframe used (SAQ A-EP if some page controls exist)
  • Scope-reduction options include (a) enforce iframe-only, (b) tokenise stored logs
  • Merchant level correctly identified using published thresholds

Log in to submit your deliverable for AI review.

Log in / Register