PCI DSS 12.5.2 requires you to document and confirm scope at least every 12 months and upon significant change to the in-scope environment. 6.5.2 adds that after a significant change you confirm all applicable requirements are in place on new or changed systems. The standard does not define "significant", so you set and document your criteria. Not legal advice.
What scope confirmation includes
At a minimum, the SAQ D text says the validation includes:
- Identifying data flows for each payment stage and channel.
- Updating data-flow diagrams per 1.2.4.
- Finding every location account data is stored, processed or transmitted, including outside the defined CDE, applications that process it, transmissions between systems, and file backups.
- Identifying system components in the CDE, connected to it, or able to affect its security.
- Identifying segmentation controls and the justification for out-of-scope environments.
- Identifying third-party connections to the CDE.
- Confirming all of these are included in scope.
Define "significant" in your own words
Because the text does not define it, many teams write a short list. Examples of criteria you might choose, as an illustration only:
| Change | Treat as significant? |
|---|---|
| New service that receives or forwards card data | Likely |
| New third-party script or SDK on a payment page | Likely |
| Change to network segmentation or firewall rules around the CDE | Likely |
| New logging pipeline that may capture card data | Likely |
| Copy changes on a marketing page | Unlikely |
| Routine library patch | Usually not, but note it |
Whatever you pick, get it approved and apply it consistently.
Wire it into the pull request flow
- Add a pull request field: touches payment flow, data stores, third parties, segmentation?
- If yes, assign a scope review ticket to the compliance owner.
- Update the data flow diagram and component list.
- Run the checks 6.5.2 expects on the changed systems.
- Link the evidence to the change record from 6.5.1.
Why it matters
Significant change also triggers a scan or test elsewhere: 11.3.1.3 and 11.3.2.1 ask for internal and external scans after significant change, and 11.4.2 and 11.4.3 ask for penetration testing after significant upgrades or changes. One definition drives several obligations.
Quick check
Who defines a significant change?
The SAQ D text does not. You define and document it, and your assessor reviews it.
Is the assessor's scoping check the same as 12.5.2?
No. The note says the annual confirmation is performed by the entity and is not replaced by the assessor's scoping confirmation.
On Safeguard: asset discovery helps find systems you may have missed, and compliance and evidence automation keeps the review records. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
