PCI QSA
Company
CERT-In
Empanelled Firm
PCI DSS
Req. 11.4.5 Aligned
Analyst-Led
Testing
What We Assess
Cardholder Data Environment
Out-of-Scope Segments
Connected-to Systems
Firewall & ACL Boundaries
VLANs & Routing
Cloud Network Segments
Remote Access Paths
Wireless-to-Wired Boundaries
Our Network Segmentation Testing Methodology
A structured approach to prove whether segmentation controls isolate sensitive environments.
Scope & Segment Mapping
Identify sensitive zones, out-of-scope segments and segmentation controls.
Test Point Planning
Agree test locations inside each out-of-scope segment and test windows.
Connectivity Testing
Probe ports and protocols from each segment toward the sensitive environment.
Control Bypass Attempts
Test routing, ACL and firewall paths that could bypass isolation.
Result Validation
Confirm any open paths and whether they are approved and justified.
Impact Analysis
Assess what an open path would expose and its effect on scope.
Reporting
Deliver segment-by-segment results, evidence and remediation actions.
Retest & Closure
Retest closed paths and confirm isolation.
Deliverables You Can Expect
Every engagement tests from each agreed segment, not from a single sample point.
Supporting Services
Extend segmentation testing into PCI DSS compliance, firewall review and penetration testing.
Benefits of Network Segmentation Testing
Segmentation testing proves that the controls you rely on to limit scope and risk actually work.
Proven Isolation
Evidence that sensitive environments are separated.
Reduced PCI Scope
Supports keeping out-of-scope networks out of scope.
Hidden Paths Closed
Unexpected routes between zones found and fixed.
Compliance & Audit Readiness
Segmentation evidence ready for your QSA or auditor.
Why Security Teams Choose QRC
PCI expertise. Thorough segment coverage. Evidence your assessor can rely on.
Listed by the PCI Security Standards Council as a Qualified Security Assessor company.
Listed by CERT-In as an empanelled information security auditing organization.
Tests run from each agreed out-of-scope segment toward sensitive zones.
Verified risks with fewer false positives, so your team acts on real risk, not tool noise.
Structured outputs that support ISO 27001, PCI DSS, SOC 2 and other frameworks.
Our team remains available after delivery to support remediation planning and revalidation.
Client Results
How organizations have used QRC segmentation testing to prove isolation and support PCI scope.
Segmentation Testing Resources
Practical guides and tools to help you design, test and maintain effective segmentation.
PCI DSS Network Segmentation: Explained
Network segmentation is the practice of dividing a computer network
Frequently Asked Questions
Testing that proves whether segmentation controls isolate sensitive environments, by attempting connections from each out-of-scope segment toward them.
PCI DSS requires segmentation controls to be tested at least every 12 months and after changes to them. Service providers must test at least every six months.
A firewall review analyzes rules on paper. Segmentation testing proves in practice whether traffic can cross between segments.
Open paths are validated, documented and prioritized for remediation, then retested. An unexpected path may bring more systems into PCI DSS scope.
Ready to Prove Your Segmentation Works?
Define your segments and sensitive zones, uncover unexpected paths, and move forward with clear evidence.