What is the scope of a PCI DSS assessment for a network that is not segmented?
Without proper network segmentation to isolate the systems that store, process or transmit cardholder data from those that do not, all system components in that network are considered part of the cardholder data environment, the entire network is in scope for PCI DSS, and all PCI DSS requirements apply. You only have to be compliant with the majority of criteria. PCI is requires 100% compliance, so if you fail even one of the criteria, you are not in compliance with PCI. The standard is not meant to be something to strive for. Failing to achieve even one of the requirements, is failing to meet a basic standard for handling cardholder information. All companies that routinely handle this type of data should meet or exceed the standard. It’s just good business.
