Your acquiring bank does not care about your threat model. They care whether you have a current Attestation of Compliance. PCI DSS is not a law passed by a legislature; it is a commercial contract written by the card brands and enforced by the acquirer. The consequence of non-compliance is not a regulatory fine. It is losing the ability to process payments. The acquirer’s incentive is continuity of processing. They want the document that proves you can keep accepting cards tomorrow morning. Everything else is your problem.
The Attestation of Compliance is a one-page summary. The Report on Compliance behind it is hundreds of pages of evidence. The board reads the one page. It says the organization is compliant as of a specific date, within a defined scope, based on a sample of controls. The board hears that the organization is secure. Those are two different sentences. The attestation is a photograph of the environment on the day it was assessed. The environment itself is a continuous operation. The assessment ends in March. In April, a new application is deployed in the cardholder data environment without a scope review. In June, an engineer opens a firewall port to troubleshoot a latency issue and forgets to close it. In September, the attestation is still valid on paper. The environment being assessed is no longer the environment that is running.
The first question in any assessment is not what controls you have. It is what is in scope. Scope determines the size of the audit, the control burden, the cost, and the blast radius. Cardholder data contaminates every system, network segment, and administrative process it touches. The architectural goal is not to build better shielding around the entire infrastructure. The goal is to amputate the data from the rest of the business.
Replacing a sixteen-digit primary account number with a token at the point of entry is a risk reduction mechanism that happens to produce a compliance benefit. When a global insurer replaces its premium billing platform, the expensive decision is whether raw card numbers enter the new platform at all. If the core ledger stops receiving raw numbers and starts receiving irreversible tokens, a massive block of infrastructure instantly falls out of scope. The tokenization vault becomes the new boundary. The business case for the architecture team is not about passing the audit. It is about avoiding the cost of bringing a sprawling, multi-jurisdiction institutional environment into scope and keeping it there.
Procurement teams collect Attestations of Compliance from third-party payment processors and file them. The processor’s attestation covers the processor’s environment. It does not cover the integration points, the data flows, or the shared responsibility gaps. A custodian bank might route payments through a gateway with three network hops. Two of those hops sit in neither the bank’s scope nor the processor’s scope. Nobody owns the gap. That is where the breach happens.
Inside the environment, legacy systems create their own friction. A mainframe batch feed cannot support modern encryption standards or multi-factor authentication. The organization writes a compensating control, relying on physical access limits and network segmentation to bridge the gap. The Qualified Security Assessor accepts it. The compensating control is an exception with a control number. It gets reviewed annually. The spreadsheet gets a new review date, the mainframe remains untouched, and the organization pays an annual tax in audit friction to keep the exception alive.
When the chief information officer presents the signed report to the steering committee, a director will inevitably ask if this means the recent warnings from the national data protection authority no longer apply to the broader customer database. The assessment only covers the sixteen-digit card numbers, leaving millions of customer health, identity, and financial records entirely outside the scope of the report. The report is evidence about an assessed environment, not a warranty on the enterprise.
The board needs two documents. The first is the attestation, which satisfies the commercial requirement to process cards. The second is a risk narrative that explains what was excluded, what has changed since the assessment, and where usable card data still lives. If the board only sees the attestation, they will assume the risk narrative is covered by it.
Assessors sample systems, configurations, and logs to form a representative view. They check a fraction of the workstations used by customer service representatives and review a subset of the firewall rules. A passing grade means the sample met the baseline on the day it was measured. Attackers do not sample. They find the one system excluded from the sample, the unreviewed firewall rule, or the undocumented batch feed that passes card data to a downstream logging server. The assessment validates the sample, but the rest of the environment continues to operate.