Connect. Secure. Manage.
PCI DSS Network Segmentation Testing
Scope authorised segmentation tests for payment environments and produce network evidence for the customer's assessor, without claiming certification.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
PCI DSS network segmentation testing checks whether the agreed boundaries around cardholder data work as intended. We support authorised network tests and evidence gathering on Cisco and Meraki systems. Scope is agreed with your PCI owner and assessor. Separate VLANs or a general scan alone do not establish effective separation or overall PCI DSS compliance.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Agree the assessment boundary before testing
The customer must identify the cardholder data setup, connected systems, security-impacting services and the systems proposed as out of scope. We review that scope with the relevant assessor or programme owner before choosing test positions. A network diagram is useful. But it does not settle scope if important management, authentication or shared-service dependencies are missing.
The engagement also confirms the applicable PCI DSS needs, testing methodology and assessment duties. We do not assume that the same evidence or schedule applies to every merchant and service-provider arrangement. The agreed plan records what the customer needs to show and which decisions remain with its assessor or compliance owner.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Obtain explicit permission and safe operating conditions
Written approval names the systems, test locations, allowed methods and time window. Payment services may have strict uptime needs. Equipment run by another firm may also need that firm’s approval. Being able to reach it from the customer’s network does not give us permission to test it.
We establish contacts, stop conditions and a recovery process before active work begins. Where a particular technique presents unacceptable risk to the live service, the alternative and its evidential limitation are agreed. A restricted test should not later be described as covering scenarios that were excluded for safety or lack of permission.
A useful starting point
Tell us what is happening.
A short description of the problem is enough for an initial discussion.
Review every relevant segmentation path
The assessment identifies the controls used to maintain separation, such as firewalls, routed boundaries, access lists and supported virtual-network controls. We map the routes that traffic can take, including wireless, remote access, management connections and alternative gateways where relevant to scope. A single tested firewall interface does not prove the effectiveness of a different untested path.
Virtualisation and cloud networking may introduce paths outside the physical Cisco estate. We identify those dependencies and coordinate with their owners. The report makes clear which controls were tested directly and which require evidence from another team, rather than assuming physical-network isolation covers every workload relationship.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Test intended isolation with representative sources
Testing is designed around the segmentation claim. We use authorised source positions representing the relevant out-of-scope systems and assess whether they can reach the protected setup through prohibited paths. The exact methods and coverage are agreed with the customer's assessment team, taking account of the technology and the potential impact on payment services.
We also check valid shared-service links when they affect the result. Each allowed link needs a recorded purpose and suitable restrictions. Its presence alone is neither a failed test nor proof of an acceptable design. The evidence explains what happened and which control allowed or blocked the connection.
Distinguish configuration evidence from tested behaviour
A rule that appears to deny traffic is useful design evidence, but testing examines what the live path actually does. We compare setup, routing and observed results, investigating discrepancies rather than selecting whichever source gives the most reassuring answer. Alternative paths, stale rules and unexpected translation can alter the outcome.
The report records test positions, destinations, methods, timing and limitations at an appropriate level of detail. Sensitive network information is protected and shared only with authorised recipients. We avoid including unnecessary payment data or unrestricted credentials in evidence files. The aim is to show control behaviour, not collect business data unrelated to the test.
Remediate and retest failures
Where isolation does not behave as intended, we document the affected boundary and the evidence supporting the finding. Remediation may require a rule change, routing correction, revised service placement or a broader scope discussion. Production changes are separately authorised and planned with the teams responsible for the affected services.
Retesting checks the original failing path and relevant consequences of the correction. The record distinguishes an implemented change from a checked result and identifies any outstanding restrictions on coverage. A finding is not closed simply because an engineer reports that a firewall rule has been edited.
Keep the evidence connected to change management
Segmentation can be affected by new services, cloud connections, firewall changes and infrastructure replacement. We help the customer identify which network changes should trigger review under its PCI programme. The agreed testing schedule and change-related needs remain aligned with the current standard and assessor guidance, rather than being inferred from a generic website article.
MCI's network segmentation services can support the design and engineering work around the testing engagement. We do not present this service as Qualified Security Assessor status, an Attestation of Compliance or a guarantee of PCI DSS compliance. The deliverable is scoped network evidence that the customer's responsible assessor can assess within the wider programme.
Technical references
- PCI SSC document library: PCI DSS v4.0.1 — PCI Security Standards Council
- PCI DSS v4.0.1 publication and scope of revision — PCI Security Standards Council
- Technical guide to information security testing and assessment — NIST
Talk to a specialist
Need a specialist view?
Tell us what is affected, what changed and what your team has already checked. A short outline is enough to start.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.