Financial organizations segment internal networks to limit how far an intruder can move and to keep systems that handle cardholder data separate from everything else. Firewalls between internal zones enforce the split. Done well, it also reduces the number of systems that fall inside PCI DSS scope.
What is internal segmentation?
Most firewalls sit at the edge of the network. Internal segmentation adds enforcement between zones inside, for example between the corporate network and the payments environment. The term "internal segmentation firewall" is used by some vendors, but the idea is general: firewall rules, router configurations or other controls between internal zones.
PCI's scoping guidance describes segmentation as additional controls to separate systems with different security needs, using logical controls, physical controls or both. Examples it names include firewalls and router configurations preventing traffic between out-of-scope networks and the cardholder data environment.
Why does it matter for PCI DSS?
The PCI SSC says the standard applies to all system components included in or connected to the cardholder data environment (CDE). Systems with a communication path to the CDE are "connected to" systems and in scope. Segmentation can reduce scope by keeping in-scope and out-of-scope systems separate.
There is a subtlety the guidance spells out. When a firewall is used to control access between in-scope systems, that supports PCI requirements but is not scope-reducing segmentation. Only controls that separate in-scope from out-of-scope systems reduce scope. And the council cautions that segmentation may not be effective for every configuration, and that out-of-scope does not mean unprotected.
Does segmentation replace zero trust?
No, and NIST is clear why. SP 800-207 says zero trust focuses on resources, not network segments, because location is no longer the prime factor in a resource's security posture. NIST SP 800-82 makes a related point for operational technology: boundary devices between zones do not mitigate lateral movement risk within a zone.
So segmentation is one layer. It limits blast radius between zones. Identity checks and least privilege limit it inside zones.
What goes wrong in practice?
Rules accumulate. A temporary exception for a migration becomes permanent, and the segment slowly becomes a flat network again. Shared services, such as directory, patching and monitoring, often connect to both sides. The PCI guidance devotes whole sections to shared services and administration workstations outside the CDE, because they are where segmentation quietly fails.
A constructed example: a regional lender puts its card processing servers in their own zone. A year later a backup server in the corporate zone is given access to the zone to copy files. That server is now connected to the CDE and in scope, along with every system that can reach it.
How do you prove segmentation works?
Configuration review is not enough. PCI's guidance includes a section on verifying segmentation of out-of-scope systems, because a rule that exists on paper may not behave as intended. Test it. From a host in an out-of-scope zone, attempt connections to systems in the CDE and confirm they fail. Repeat after any network change.
Keep the evidence. Auditors and your own team will want to see what was tested, when, by whom and what the result was. A dated test record is worth more than a diagram.
How to check or apply this
- Draw the data flows for cardholder and other sensitive data.
- Define zones by sensitivity and function, and name an owner for each.
- Set default deny rules between zones and allow only documented flows.
- List shared services that touch more than one zone and treat them as in scope.
- Test segmentation, for example by attempting connections from out-of-scope networks to the CDE.
- Review rule sets on a schedule and delete expired exceptions.
- Log denied and allowed flows between zones for review.
- Combine with strong authentication so a single stolen credential does not cross zones.
Quick check
Is segmentation mandatory for PCI DSS?
PCI's guidance treats it as a way to reduce scope, not a requirement. Without it, the whole connected network is in scope.
Does a firewall between zones always reduce PCI scope?
No. Controls that manage access between in-scope systems do not reduce scope. Only separating out-of-scope systems from the CDE does.
Sources
- PCI SSC, Guidance for PCI DSS Scoping and Network Segmentation
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
Last reviewed: 18 October 2026.
