Demo: shrinking PCI scope with tokenization
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
redesign payments so fewer systems handle card data; prepares SRA-009-LAB1.
Draft outline details
Step by step
- Trace where card data flows today and list all in-scope services (verify scope rules with the compliance officer).
- Propose a hosted capture or payment provider that returns tokens to the browser and back end.
- Redesign flows so orders, refunds, and payouts use tokens; confirm the remaining in-scope boundary.
- Plan migration and verification: remove old stores and logs that held card data.
- Planned mistake: declare scope reduced while old logs and an analytics export still contain card numbers. Fix: scan stores and pipelines, purge, and add a detection check.
- Review with the compliance officer and record evidence.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.