PCI segmentation evidence collectors expect

Overview

PCI scoping is diagram + config proof—not vibes that VLAN names imply security.

Evidence bundle

Network diagrams with CDE highlighted, firewall rulesets exported, vulnerability scan reports in-scope, ASV attestations.

Common gaps

Flat wireless guest bridging POS VLAN “temporarily.”

Quarterly internal scan

Even if ASV annual requirement known—catch drift early.

Consultant coordination

QSA calendar booked 90 days before SAQ expires to avoid rush fees.

Language

Never tell client “we guarantee PCI pass”—assist their AOC—they sign attestations.