Scope First, Everything Else Second

PCI fines follow scope creep: stored PAN, logs with CHD, and connected systems pull environment into assessment.

Coordinate with NIST CSF, Internal Controls, and Compliance Checklist.

Scoping Checklist

  • Map card flows: web, terminal, phone, SaaS billing — see SaaS Sales Tax for billing overlap.
  • Inventory systems storing PAN, auth data, or logs.
  • Segment card environment; document connected-to systems.
  • Confirm provider AOCs cover outsourced functions — see SOC 1 vs SOC 2.
  • Freeze scope memo before SAQ/ROC selection.

Never store SAD post-authorization; truncate/mask PAN in Month-End Close packets.

SAQ Selection Map

Situation Likely SAQ Watchout
Fully outsourced e-commerce, no electronic storage A Confirm redirect/iframe eligibility
E-commerce with impacted web server A-EP Logging and patching burden jumps
Terminal-only, no e-commerce B / B-IP / P2PE Terminal inventory + tamper checks
Mixed or stored data D Full control set

Confirm with acquirer; wrong SAQ is a finding.

Finance Controls That Satisfy 4.0

  • Access: unique IDs, MFA for admin, quarterly reviews — see QuickBooks vs Xero Controls.
  • Logging: centralized, time-synced, reviewed; retain per requirement.
  • Patching: risk-ranked cadence with emergency path for internet-facing.
  • Vendor changes: dual approval for payment pages and provider credentials.
  • Backup: tested restore for billing and Bookkeeping data.

Evidence Binder

Per requirement: control description, owner, config screenshot/log sample, test result, date. Reuse SOX 404 and Audit Procedures workpaper standards: who, when, support, reviewer.

Report status to Audit Committee quarterly; track future-dated 4.0 items as closed or compensated.

Customized Implementation: When Standard Controls Don’t Fit

4.0’s customized implementation lets you meet an objective differently — with a catch: each instance needs a targeted risk analysis, documented constraints, testing procedures, and maintenance plan. Legitimate uses for finance teams:

Situation Customized approach What to document
Legacy billing system can’t enforce MFA Compensating network segmentation + jump host with MFA + session recording Why MFA is infeasible, how the alternative meets the objective, quarterly test
Cloud logging retention below requirement Export to immutable SIEM with alerting Export completeness check, retention proof
Terminal fleet can’t run current OS Network isolation + allow-listed traffic + accelerated replacement plan End-of-life dates, milestone tracking

What fails: vendor letters asserting “our product is secure” with no testing, inherited controls nobody validates, and risk analyses copied year to year. Each customized control gets re-tested on the same cycle as the requirement it replaces — file the analysis with the control owner sign-off and review it when systems change, not just at assessment. Track all of them in the quarterly Audit Committee report as a separate section.

SAQ A-EP Deep Dive (Where E-Commerce Teams Stumble)

SAQ A looks easy; A-EP is where scope explodes. You land in A-EP when your web server impacts payment security — hosting the iframe, running JavaScript on the payment page, or managing redirects. The jump adds ~140 requirements, dominated by:

  1. Vulnerability management. Quarterly scans by an ASV plus internal scans after significant changes, with rescans proving remediation — calendar them, don’t discover them at assessment.
  2. Penetration testing. Annual plus after significant upgrades, covering both network and application layers of the in-scope environment.
  3. Change control. Documented approval, testing, and back-out for every payment-page change — the marketing team’s “quick pixel add” is now a compliance event. Route all payment-page changes through the same approval as AP Fraud vendor changes.
  4. Logging and monitoring. Daily review of security events for the payment environment — automate collection, staff the review, retain per requirement.

If A-EP scope keeps growing, the strategic fix is architectural: fully outsource the payment page (redirect/iframe with no impacting scripts) to drop back to SAQ A. The engineering cost usually beats the annual assessment delta — coordinate with Netsuite vs Intacct checkout decisions and E-Invoicing billing overlaps.

FAQ

Does tokenization remove scope?

It reduces but rarely eliminates. Confirm what touches CHD and what the provider attests to in its AOC.

What is the fastest win?

Segmentation diagram + provider AOC file + MFA + logging review cadence this month.

Next Steps

  1. Freeze scope diagram and SAQ with acquirer.
  2. Assign owners for logging, patching, and vendor reviews.
  3. Schedule QSA or internal pre-assessment before renewal.