Scope a PCI DSS assessment — identify the CDE
Scenario
SwiftLend has just launched a co-branded credit-card product. Customers apply through the SwiftLend app; card manufacturing is by a bank partner; but SwiftLend processes ~500,000 card transactions per year for card top-ups and repayments. Card data touches these systems: 1. Mobile app (card details entered via web-view iframe from Razorpay) 2. SwiftLend Payment Gateway integration (uses Razorpay APIs — API token stored in AWS Secrets Manager) 3. Backend transaction logs (Postgres — stores masked PAN + last 4 digits) 4. Fraud-detection service (Python, receives transaction metadata but no full PAN) 5. Support ticketing (Freshdesk — customers sometimes paste full card numbers in tickets, currently no scrubbing) 6. Backup system (encrypts + copies Postgres nightly to a separate AWS account)
Your role
You are the PCI DSS Lead.
Your task
Produce the CDE (Cardholder Data Environment) diagram + written scope statement: 1. For each of the 6 systems: In-CDE / Connected-to-CDE / Out-of-scope — with justification 2. Segmentation strategy (what needs isolation) 3. Merchant level (based on transaction volume) 4. Applicable SAQ type or full ROC 5. TWO scope-reduction options with cost/effort tradeoff
Deliverable format: Written scope document ~600 words + a simple diagram (ASCII or Mermaid)
Toolkit
- PCI DSS v4.0 CDE definition: any system that stores, processes, transmits, or is connected to CHD
- Iframe from Razorpay = PAN never touches your servers = SAQ A eligibility
- 500K trans/year — Level 2 or Level 3 merchant (check exact bank thresholds)
- Freshdesk PAN paste = huge scope violation, needs immediate DLP or PII scrubber
Success criteria (what the AI grades against)
- Freshdesk correctly flagged as CDE-touching due to PAN paste — needs remediation
- Backup system is IN scope (holds encrypted PAN)
- Fraud-detection service correctly assessed (metadata only = probably out of scope)
- SAQ A recommended IF tokenisation + iframe used (SAQ A-EP if some page controls exist)
- Scope-reduction options include (a) enforce iframe-only, (b) tokenise stored logs
- Merchant level correctly identified using published thresholds
Log in to submit your deliverable for AI review.
Log in / Register