The Dangers of Scope Creep for PCI Compliance

One of the most worrying things that can happen during an assessment is scope creep. The name even sounds scary. In this video, we're going to talk about:

1. What scope creep is
2. How it happens, and
3. What your organization can do about it

Hi I'm Sully Perella, a PCI practice leader here at Schellman, and in my 10+ years of experience doing PCI, both big and small organizations, have scope creep problems.

Scope creep occurs when your cardholder data environment is accessible in a way that you did not anticipate. Scoping an environment is all about the data. You've got the cardholder data environment. These are the systems that store process and transmit cardholder data. Then you have the systems that are not that, but they can impact the security of those systems and networks. When identifying the scope of the environment, confirming that, look at authentication domains, look at the reporting functions, logging functions and other management systems involved, which apply patching or perform other security-related functions that can impact that. Based upon that analysis, you'll have your scope and can confirm whether or not you've got scope creep.

The biggest concerns we see with scope creep revolve authentication domains where systems were more accessible than you thought. Another big concern are in network segments that aren't truly segment where rules permit traffic to flow bi-directionally, where the exchange of data that you don't want to leave your organization very well could.

Take time to test it. How do I get it? What can I do to get access to that data, to those systems? And that is going to pretty much confirm what your organization needs to do to confirm scope. Before an assessment begins or at the very beginning, take the time to talk to your QSA, administrators, and penetration testers. Make sure that scope is correctly defined. By doing that at the beginning, you're going to avoid a whole lot of headache later.

Is scope creep giving you the willies? Talk to us. We'd love to talk through your environment, how you handle that card data and how you can avoid scope creep.