Scoping

Applies to. Every entity assessed against v4.0.1. 12.5.2 requires the entity itself to document and confirm its PCI DSS scope at least once every 12 months and after any significant change, covering payment data flows by stage and channel, every place account data is stored, processed or transmitted (including backups and places outside the current CDE), all system components in, connected to or able to affect the CDE, the segmentation controls relied on, and every third-party connection into the CDE. 12.5.2.1 raises the frequency to at least once every six months for service providers.

Example. A retailer moves its e-commerce checkout to a new hosted page and adds a refund tool for call-centre staff. That is a significant change, so under 12.5.2 it redraws the data-flow diagram, records where refund data now lands, adds the call-centre workstations to the component inventory and rechecks that the office network is still segmented from the CDE, before the next assessment rather than after it.

Limits. Scoping is not segmentation: segmentation is one way to shrink scope, while scoping decides what is in and out, and 12.5.2 requires a written justification for anything treated as out of scope. Scope is not limited to systems that touch card data; anything connected to the CDE or able to affect its security is in scope. The confirmation under 12.5.2 is performed by the entity, not by the assessor, and its documented results are examined as evidence during an assessment (12.5.2.a and 12.5.2.b). Choosing an SAQ is a separate question from scoping and comes after it.