Dallas, Texas · Technology consulting since 201635 services · 3 practices · 8 industries Technology in ActionPartnershipsMedia817-968-0523
Speak With an Expert
FinTech & Payments · Confidential client

PCI DSS Scope Reduction for a Fleet Fuel-Card Issuer

In-scope systems cut from 780 to 214, and a Report on Compliance signed with no requirement marked Not in Place.

Discuss a similar engagementAll projects
Client name withheld by agreement
Client
Fleet fuel-card issuer, 1.4M active cards
Region
Kansas City, Missouri
Year
2024
Duration
16 weeks
Scope
780 in-scope systems · 14,000 fuel-site terminals
Practice
Financial Services

The challenge

What was at stake.

A fleet fuel-card issuer processes authorizations from 14,000 fuel-site terminals for trucking and service fleets. Over a decade its cardholder data environment had absorbed reporting servers, a data warehouse and two call-center platforms that had no business being there.

PCI DSS 4.0.1 made every one of those systems more expensive to keep in scope. The CFO had a number in mind for compliance cost, and the existing footprint made it impossible to hit.

What we did

The approach, step by step.

  1. 01

    Card data traced end to end

    Discovery scans across 780 systems, confirmed by packet capture at the authorization switch, showed exactly where primary account numbers landed and where they only passed through.

  2. 02

    Tokens where card numbers were not needed

    The data warehouse, fraud analytics and customer service tools moved to format-preserving tokens, taking 566 systems out of scope.

  3. 03

    Call-center payments descoped

    DTMF masking replaced agents keying card numbers, removing two contact-center platforms and their recordings from the environment.

  4. 04

    4.0.1 requirements built and evidenced

    Targeted risk analyses, payment-script inventory, authenticated scanning and MFA into the environment were implemented and documented in the form the QSA asked for.

Outcomes

What changed, in numbers.

72%
fewer systems in PCI DSS scope
566
systems moved to tokenized data
2
call-center platforms removed from scope
0
requirements marked Not in Place on the ROC
Our assessment cost went down by a third, and the QSA spent their time testing controls instead of arguing about scope.
Chief Financial Officer, client name withheld

Services delivered

Related engagements

More work in Financial Services.

All projects
Facing something similar?

Let’s talk about your version of this.

Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.

Speak With an ExpertRequest an Assessment