PCI scope map of a cinema chain

Views in this map

1. 1
   In scope todayA flat network puts nearly every system in scope, and card numbers reach ticketing.
2. 2
   After segmentationFirewalls wall off the CDE: the head-office estate and guest Wi-Fi leave scope.
3. 3
   After tokenizationP2PE terminals and tokens: only the terminals ever see a card number.

In scope today ‹ › After segmentation ‹ › After tokenization

Flows to play

• ▷
  A card at the box officeA moviegoer pays for two tickets with a card, from the tap to the bank’s approval. In every view: the card number crosses Marlow’s systems until tokenization, then goes straight to the gateway and only a token comes back.

The model behind it

54 records of 8 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• Systems 24
• PCI DSS requirements 11
• Controls 6
• Network zones 5
• Third parties 3
• Actors 2
• Sites 2
• Assessment 1

Filters

Scope and Control owner: pick a value and everything else fades.