When Saudi payment service providers, acquirers and e-commerce platforms prepare for PCI DSS certification, one question determines the size, cost and complexity of every subsequent control: where does the cardholder-data environment end? The PCI DSS network segmentation requirement under version 4.0 — specifically Requirement 1.3.3 — provides three recognised methods to isolate the CDE from out-of-scope systems, and each method carries different implementation, validation and documentation obligations. Choose the wrong approach and your CDE expands to include infrastructure that need not be audited; choose correctly and you reduce scope, audit burden and the surface area an attacker can exploit.
This article explains what the Payment Card Industry Security Standards Council requires under Requirement 1.3.3, describes the three segmentation methods the standard recognises, identifies the gaps Saudi organisations typically encounter during readiness assessments, and sets out a practical order of work to implement, test and document segmentation that satisfies both your Qualified Security Assessor and your business objectives.
What PCI DSS v4.0 Requires Under Requirement 1.3.3
Requirement 1.3.3 states that network segmentation must be in place to isolate the cardholder-data environment from out-of-scope networks, and that segmentation must be confirmed at least once every twelve months and after any changes to network configuration or segmentation controls. The standard does not prescribe a single technology; instead, it recognises that organisations may achieve isolation through physical separation, logical controls or a combination of both.
The critical change in version 4.0 is the explicit requirement for penetration testing to validate segmentation effectiveness. It is no longer sufficient to produce network diagrams and firewall rule sets. You must demonstrate, through adversarial testing, that an attacker who compromises a system in the out-of-scope network cannot traverse segmentation controls to reach the CDE. This validation must be performed by a qualified penetration tester and repeated annually and after significant changes.
The Three Network-Segmentation Methods Recognised by PCI DSS
1. Physical Separation
Physical segmentation means the CDE operates on dedicated hardware with no shared network infrastructure connecting it to out-of-scope systems. Separate switches, routers, cabling and, in some implementations, separate data centres. An air gap exists: no logical path permits traffic to flow between environments without passing through a controlled gateway.
Advantages: Physical separation is the simplest to validate. If the environments share no cables or wireless access points, an attacker in the corporate network has no route into the CDE. Documentation is straightforward: rack diagrams, cabling schedules and photographs of physically distinct infrastructure.
Disadvantages: Cost and operational complexity. Maintaining duplicate infrastructure increases capital expenditure and complicates disaster recovery, monitoring and administration. For Saudi acquirers processing high transaction volumes, physical separation may be impractical unless the CDE is already hosted in a dedicated facility.
When to choose this method: When your CDE is small, transaction volumes justify dedicated infrastructure, or regulatory or contractual obligations require air-gapped environments.
2. VLAN Isolation with Firewall Enforcement
VLAN-based segmentation uses virtual local-area networks to logically separate the CDE from out-of-scope systems on shared physical infrastructure. Traffic between VLANs is routed through a firewall or layer-3 switch that enforces access-control rules. Only explicitly permitted traffic — for example, payment-gateway API calls from the web application tier — is allowed to traverse the boundary.
Advantages: Cost-effective and flexible. You can segment the CDE without duplicating switches or routers. Changes to segmentation are implemented through configuration rather than cabling, and monitoring tools can inspect inter-VLAN traffic at the firewall.
Disadvantages: VLAN hopping attacks, misconfigurations and shared management planes introduce risk. If an attacker compromises the switch management interface or exploits a VLAN-hopping vulnerability, segmentation collapses. Validation is more complex: penetration testers must attempt to bypass firewall rules, exploit switch vulnerabilities and test for misconfigurations that permit unauthorised traffic.
When to choose this method: When you operate a consolidated data centre, require flexibility to adjust segmentation as applications evolve, and possess the expertise to configure and harden network devices according to PCI DSS Requirement 1 and Requirement 2.
3. Micro-Segmentation Using Software-Defined Controls
Micro-segmentation applies segmentation policies at the host or workload level, typically using software-defined networking, host-based firewalls or container network policies. Each server, virtual machine or container is assigned a security policy that permits only the specific traffic required for its function. The CDE is defined not by VLAN membership but by policy tags that travel with the workload, even as it moves between physical hosts or cloud availability zones.
Advantages: Granular control and dynamic adaptation. Micro-segmentation reduces the blast radius of a compromise: even if an attacker breaches one CDE component, lateral movement is constrained by per-host policies. It is well suited to cloud-native architectures, containerised payment applications and environments where workloads scale elastically.
Disadvantages: Complexity in policy design, visibility and validation. You must map every legitimate traffic flow, translate it into enforceable policies, and maintain those policies as applications change. Penetration testing must confirm that policies are correctly applied to every workload and that no bypass exists through management APIs, orchestration platforms or shared storage.
When to choose this method: When your payment platform runs in public cloud, uses containerised microservices, or requires segmentation to adapt automatically as workloads scale or migrate.
Common Gaps Saudi Organisations Encounter During Segmentation Readiness
Incomplete Scoping and Data-Flow Mapping
Many organisations begin segmentation without a complete inventory of where cardholder data is stored, processed or transmitted. Payment data may reside in application logs, database replicas, backup systems or third-party analytics platforms that were not included in the original CDE scope. The result: segmentation controls protect only part of the environment, and the QSA expands scope during the assessment.
The first step is card-data flow mapping: trace every API call, database query, file transfer and log entry that touches cardholder data, from the point of capture to the point of deletion or tokenisation. Document every system, network segment and third-party connection involved. Only then can you draw the segmentation boundary with confidence.
Segmentation Controls That Permit Unnecessary Traffic
Firewall rules often accumulate over time. A rule added to troubleshoot a production issue remains in place long after the issue is resolved. The result is a segmentation boundary that permits far more traffic than the business requires, expanding the attack surface and complicating penetration-test validation.
Review every rule that permits traffic into or out of the CDE. For each rule, identify the business justification, the specific systems and ports involved, and whether the rule is still required. Remove or tighten rules that do not meet the principle of least privilege. Document the justification for every remaining rule in the segmentation evidence pack.
Lack of Penetration-Test Validation
Version 4.0 makes penetration testing of segmentation controls mandatory, yet many organisations treat it as an afterthought. They implement VLANs and firewalls, produce network diagrams, then discover during the QSA assessment that segmentation is ineffective because firewall rules were misconfigured, VLANs were not enforced on all switch ports, or management interfaces were accessible from out-of-scope networks.
Penetration testing must be performed before the QSA assessment, with sufficient time to remediate findings. The tester must attempt to traverse segmentation controls from the out-of-scope network, exploit misconfigurations, and confirm that no path exists into the CDE. The test report becomes part of your evidence pack and demonstrates to the QSA that segmentation has been validated by an independent party.
Inadequate Documentation
Even effective segmentation fails PCI DSS if it is not documented. The QSA will request network diagrams showing the CDE boundary, data-flow diagrams illustrating how cardholder data moves between systems, firewall rule sets with business justifications, and penetration-test reports confirming segmentation effectiveness. If these documents do not exist or are incomplete, the assessor cannot verify compliance.
Prepare a segmentation evidence pack that includes current network diagrams, VLAN assignments, firewall configurations, access-control lists, penetration-test reports and a narrative explanation of how segmentation is implemented and validated. Update this pack annually and after any change to network configuration.
A Practical Order of Work to Implement and Validate Segmentation
Step 1: Scope the Cardholder-Data Environment
Conduct card-data flow mapping to identify every system, application, database, network segment and third-party connection that stores, processes or transmits cardholder data. Include backup systems, log aggregators and disaster-recovery environments. Produce a scoping document that lists every in-scope component and explains why out-of-scope systems are excluded.
Step 2: Choose the Segmentation Method
Evaluate the three segmentation methods against your infrastructure, transaction volumes, cloud strategy and operational capabilities. Consider cost, complexity, flexibility and the effort required for penetration-test validation. Document your choice and the rationale.
Step 3: Design and Implement Segmentation Controls
Configure VLANs, firewalls, access-control lists or micro-segmentation policies to isolate the CDE. Apply the principle of least privilege: permit only the specific traffic required for business operations. Harden network devices according to PCI DSS Requirement 2. Remove or disable unnecessary services, protocols and management interfaces accessible from out-of-scope networks.
Step 4: Validate Segmentation Through Penetration Testing
Engage a qualified penetration tester to attempt to traverse segmentation controls from the out-of-scope network. The tester should simulate an attacker who has compromised a corporate workstation or server and is attempting to reach the CDE. Remediate any findings, then re-test to confirm effectiveness.
Step 5: Document Segmentation and Prepare the Evidence Pack
Produce network diagrams, data-flow diagrams, firewall rule sets with justifications, VLAN configurations and the penetration-test report. Assemble these into a segmentation evidence pack that the QSA can review. Update the pack annually and after any change to network configuration or segmentation controls.
How We Support Saudi Acquirers and Payment Platforms
Our PCI DSS Readiness & Compliance service prepares Saudi payment service providers, acquirers and e-commerce platforms for PCI DSS v4.0 certification. We begin with card-data flow mapping and scoping to define the CDE boundary, then conduct a segmentation review to evaluate whether your chosen method satisfies Requirement 1.3.3. We perform a gap assessment against v4.0 to identify deficiencies in segmentation controls, firewall configurations and documentation, then support you in closing those gaps through remediation planning and policy updates. Finally, we prepare an evidence pack for the QSA assessment or self-assessment questionnaire, including the scoping document, data-flow diagrams, gap assessment report and remediation plan. The engagement typically runs six to twelve weeks, depending on the complexity of your environment and the extent of remediation required.
For organisations that require penetration-test validation of segmentation controls, our Penetration Testing service identifies exploitable weaknesses in network segmentation, firewall rules and access controls before the QSA assessment. We simulate an attacker attempting to traverse segmentation boundaries and provide fixes your team can act on.
If you need to test detection and response capabilities against a realistic adversary who attempts to move laterally from out-of-scope networks into the CDE, our Red Teaming & Adversary Simulation service simulates a determined attacker pursuing agreed objectives to test your people, processes and technology end to end.
Closing
Network segmentation under PCI DSS v4.0 Requirement 1.3.3 is not a checkbox exercise. It is a strategic decision that determines the size of your cardholder-data environment, the cost of compliance and the difficulty of defending against payment-data breaches. Choose the segmentation method that fits your infrastructure and operational model, implement it rigorously, validate it through penetration testing, and document it thoroughly. The result is a smaller CDE, a faster QSA assessment and a more defensible payment environment.
If your organisation is preparing for PCI DSS certification and you need support with scoping, segmentation review, gap assessment or QSA readiness, we are ready to help.
