Key Takeaways
- PCI DSS network segmentation is optional scope reduction, not a mandate.
- If you use segmentation, Requirement 11.4.5 requires penetration testing at least every 12 months and after any change.
- Service providers must test segmentation at least every six months under Requirement 11.4.6.
- Network access control (NAC) supports boundary enforcement. It does not replace firewalls, the penetration test or the assessor’s scope decision.
PCI DSS does not require network segmentation, but if you use it to isolate the cardholder data environment, Requirement 11.4.5 requires you to test it at least every 12 months and after any change.
PCI DSS network segmentation is a scope-reduction method that isolates the cardholder data environment (CDE) from other networks, so fewer systems fall under assessment for the Payment Card Industry Data Security Standard (PCI DSS). Segmentation is optional. Any organization that relies on it must prove it works through penetration testing.
Portnox builds agentless access control that identifies, authenticates and controls devices before they reach a segment. This page covers which requirements touch segmentation, how often testing is due and where network access control helps enforce the boundary.
What PCI DSS Says About Segmentation
PCI DSS segmentation is a choice, not a mandate. You use it to reduce the number of systems in scope for assessment, which is PCI DSS scope reduction.
The CDE includes the people, processes and technologies that store, process or transmit payment card data, including cardholder data and sensitive authentication data. Systems connected to the CDE, or able to affect its security, are in-scope systems. Segmentation shrinks PCI scope only if it holds.
The PCI Security Standards Council (PCI SSC) published an updated information supplement on scoping and segmentation for modern network architectures in September 2024. Background: what network segmentation is and the PCI DSS compliance resource.
The Requirements That Touch Segmentation
Five groups of requirements in PCI DSS v4.0.1 touch segmentation: diagrams, traffic controls, penetration testing methodology, segmentation testing and scope confirmation. Each group maps to specific requirement numbers:
- 1.2.3 and 1.2.4: accurate network diagrams and data-flow diagrams.
- 1.3 and 1.4: controls on traffic to and from the CDE, and between trusted and untrusted networks.
- 11.4.1: a defined penetration testing methodology.
- 11.4.5 and 11.4.6: penetration tests that confirm segmentation controls isolate the CDE.
- 12.5.2 and 12.5.2.1: documented scope, confirmed at least every 12 months, and every six months for service providers.
How Often You Must Test
PCI segmentation testing is due at least every 12 months and after any change to segmentation controls or methods. Service providers test at least every six months.
Requirement 11.4.5 sets the 12-month cadence for all entities that use segmentation. Requirement 11.4.6 sets the six-month cadence for service providers. A penetration test is required, and a vulnerability scan does not substitute for it.
PCI DSS v4.0.1 is a limited revision published in June 2024. The PCI SSC retired v4.0 on December 31, 2024, and future-dated requirements became mandatory on March 31, 2025.
What Counts as Segmentation That Holds
Segmentation holds when a penetration test shows traffic between the CDE and out-of-scope systems stops at the boundary. A VLAN alone does not prove it.
Firewall rules, access control lists and device-level controls must work together. Test from outside the boundary, not from a trusted host inside it. The PCI SSC supplement also covers cloud and multi-cloud boundaries. Learn how network microsegmentation narrows the boundary further.
How NAC Helps Enforce the Boundary
NAC enforces the boundary at the device level. It decides which devices connect and which segment each one reaches.
A NAC policy works in five steps:
- Identify the device that requests access.
- Authenticate it with certificate-based authentication or the 802.1X port-based authentication standard.
- Check its device posture against policy.
- Place it in the segment its policy allows.
- Quarantine a device that fails posture, and log the decision.
Coalfire’s 2023 Compliance Report found that nearly 70% of security and IT leaders manage at least six compliance frameworks. That load makes audit evidence matter, and NAC logs show which device joined which segment and when. NAC supports compliance, and the assessor still decides scope.
Segmentation also limits lateral movement after a compromise. See endpoint remediation for what happens to a device that falls out of compliance, and Portnox NAC for the product overview.
Where Segmentation and NAC Fall Short
Neither segmentation nor NAC proves scope on its own. NAC does not replace firewalls, the segmentation penetration test or the Qualified Security Assessor’s scope decision.
The NAC service can itself fall into scope as a security-impacting component. A cloud service also adds shared responsibility, and the PCI DSS shared responsibility matrix shows how Portnox splits it.
Two wrong turns come up often: segmentation that was never tested, and the 12-month and six-month cadences mixed up. For the full list, read common PCI DSS 4.0 segmentation mistakes.
Frequently Asked Questions
Is network segmentation required for PCI DSS?
No. PCI DSS does not require network segmentation. Organizations use it to reduce the number of systems in scope for assessment by isolating the cardholder data environment from other networks. If you rely on segmentation for that purpose, Requirement 11.4.5 in PCI DSS v4.0.1 requires you to test the controls with penetration testing at defined intervals.
How often must PCI DSS network segmentation be tested?
PCI DSS v4.0.1 requires segmentation penetration testing at least once every 12 months and after any change to segmentation controls or methods. Service providers must test at least once every six months under Requirement 11.4.6. A vulnerability scan does not satisfy either requirement, because the requirement calls for a penetration test of the segmentation controls.
Is VLAN segmentation enough for PCI DSS?
A VLAN by itself does not prove segmentation. What counts is whether the controls and their configuration stop traffic between the cardholder data environment and out-of-scope networks. Firewall rules, access control lists and device-level access controls usually work alongside VLANs, and segmentation testing must confirm that the boundary holds in practice.
Can network access control reduce PCI DSS scope?
Network access control does not remove systems from PCI DSS scope on its own. It helps enforce segmentation by controlling which devices can connect and which segment each device reaches. The NAC system can itself fall into scope as a security-impacting component, so confirm with your Qualified Security Assessor. Portnox provides a PCI DSS shared responsibility matrix for its service.
What is the difference between PCI DSS 4.0 and 4.0.1?
PCI DSS v4.0.1 is a limited revision of v4.0, published in June 2024, that clarifies wording and fixes errors without adding or removing requirements. The PCI Security Standards Council retired v4.0 on December 31, 2024. Future-dated requirements became mandatory on March 31, 2025, so v4.0.1 is the version assessors use today.
What Auditors Ask You to Show
Assessors ask for evidence that your scope is current, not only that a boundary exists. Scope is an ongoing operational property, not a one-time diagram.
Expect requests for:
- Current network diagrams and data-flow diagrams
- Segmentation penetration test reports
- Access logs for devices that joined CDE segments
- Records of scope confirmation
The compliance use case and financial services use case show how Portnox supports audit evidence. The post on avoiding PCI compliance fines covers the cost of getting it wrong.
A Segmentation Claim Has to Keep Proving Itself
Segmentation is a claim you have to keep proving. Every device that connects can change whether the claim still holds, and the last test only covers the day it ran.
Request a Demo to see how Portnox identifies, authenticates and controls devices before they reach a segment. You can also read the NAC buyer’s guide or the benefits of network access control.
