PCI DSS Scoping Correct scoping is 80% of PCI DSS. Get the data flows right first. 1. Find the Cardholder Data - Trace the full payment path: capture → transmission → processing → storage → destruction - PAN storage locations: databases, logs (log scrubbing!), backups, email/ticket systems, dev/test environments - Verify truncation/masking everywhere PAN appears; confirm no SAD (sensitive auth data) persistence post-authorization 2. Define the CDE - Cardholder Data Environment: all systems that store/process/transmit CHD, plus connected systems - Identify connected-to systems: security-impact…