Virtual Local Area Network (VLAN)

Applies to. PCI DSS v4.0.1 does not name VLANs in its requirements. A VLAN comes up as one way to build the segmentation that isolates the CDE from other networks; the standard does not prescribe the method, but where segmentation is relied on to keep systems out of scope it must be documented at the scope review and penetration tested at least once every 12 months (every six months for service providers) to confirm it isolates the CDE from all out-of-scope systems.

Limits. A VLAN on its own is a logical grouping, not proof of isolation. As a matter of general practice, VLAN separation with no enforced access control between VLANs is weak, and under the standard whatever method is used must be shown to hold under segmentation testing.