EDITED APRIL 2026

Organisations that process or store payment data know the PCI DSS framework well. Its principles are clear: control access, segment networks, test regularly, and prove compliance. Yet many compliance teams find their testing and audit costs climbing year after year.

A large part of that cost is scope. Every access point, router and network that can reach systems handling cardholder data has to be included, tested or validated. That challenge is no longer confined to data centres and firewalls. It now extends to the homes, serviced offices and client sites where staff still connect to company systems.

Where PCI DSS costs really build up

The cost of PCI DSS compliance grows in proportion to the size of the environment in scope.

Testing requirements under section 11.4 call for penetration testing at least annually and after significant changes, including validation of segmentation controls (Requirement 11.4.5). When staff connect from unmanaged networks, each distinct environment adds to what has to be reviewed and evidenced.

Segmentation tests must show that systems handling cardholder data are isolated from all out-of-scope networks. The more unknown routers, Wi-Fi configurations and access methods are involved, the more complex that testing becomes.

Oversight of third-party service providers under section 12.8 adds further work. Every external route or service involved in handling or transmitting data needs documented agreements and ongoing due diligence.

Each of these tasks consumes assessor time, and assessor time is what drives cost.

Why the network edge matters

Most organisations have already hardened their internal and office networks. The exposure that remains tends to sit elsewhere.

Staff still reach company systems from personal networks, shared offices and client sites, each outside IT control. A single misconfigured router or shared connection can create a path towards the cardholder data environment (CDE). Where segmentation is used to exclude those networks, PCI DSS requires clear evidence that the segmentation is effective (Requirement 11.4.5). Fewer variations in network setup mean fewer configurations to test, less time gathering evidence, and ultimately lower audit cost.

How edge control reduces testing and audit load

Standardising off-office access has a direct effect on scope. When every staff connection passes through the same controlled, work-only network path, the assessor can validate one configuration rather than hundreds of unpredictable home setups. That simplifies segmentation testing under Requirement 11.4.5 and reduces the retesting burden.

This is where measurable cost reduction happens: fewer test variants, fewer findings, and faster evidence collection.

Design principles that support cost-efficient compliance

Certain architectural choices make PCI DSS compliance simpler and more defensible.

Clear network separation for work traffic. Segmentation between the CDE and everything else is a core principle. Where it is used to reduce scope it must be validated by penetration testing (Requirement 11.4.5). A consistent, isolated work-only network for all off-office staff makes that validation easier to plan and repeat.

Consistent, locked-down configuration and firmware. PCI DSS expects secure configuration of all system components (Requirements 2.2.3, 2.2.6, 2.2.7). Managed devices running standardised, hardened firmware reduce variance and simplify the evidence you need to produce.

Strong authentication for remote access. Multi-factor authentication is required for all remote access that could reach or affect the CDE (Requirements 8.4.1 to 8.4.3). Routing off-site connections through a single, consistent network edge makes MFA easier to apply and audit uniformly.

Clarity around third-party access. Organisations must maintain a list of third-party service providers, written agreements and ongoing due diligence (Requirements 12.8.1 to 12.8.5). A clearly defined, contracted access path with a documented configuration makes that oversight easier to evidence and reduces ambiguity over who is responsible for what.

A practical example

Consider an organisation with 300 employees who reach internal systems from home or client networks using consumer-grade routers. Every distinct configuration that could provide a path towards the CDE has to be considered during segmentation validation. Even where the CDE itself is well secured, assessors will still ask for evidence that those external paths cannot reach it.

Now picture the same 300 employees connecting through managed, identical work-only routers, with no other uncontrolled access paths. The task changes shape. The assessor can test and approve one configuration once, rather than repeating validation across hundreds of varied environments. The result is reduced scope, less duplication and lower audit cost, alongside stronger and more consistent control.

Addressing common assumptions

“We already use a VPN.” A VPN secures traffic, not the network it runs on. PCI DSS still requires segmentation testing (Requirement 11.4.5) to confirm the CDE is isolated from other devices. A managed router that separates business traffic from home or guest devices provides that evidence.

“We’ve returned to the office.” PCI DSS applies to all systems that can reach or affect the CDE, including access during travel, weekends and after-hours work. MFA and segmentation controls still apply (Requirements 8.4.2 and 11.4.5).

“Our service provider handles it.” Even where services are outsourced, ultimate responsibility remains with the organisation. PCI requires written agreements, due diligence and ongoing monitoring of each third-party provider (Requirements 12.8.1 to 12.8.5).

Where Loxada fits in

Loxada provides managed routers that create a secure, work-only connection for staff working from homes, serviced offices or client sites. Each router runs hardened firmware, updates automatically, and keeps business traffic separate from personal use. That directly supports several PCI DSS objectives:

• Segmentation validation. A uniform network design makes testing under Requirement 11.4.5 consistent and repeatable.
• Strong authentication. Routing off-site connections through one trusted network edge makes MFA easier to apply and audit.
• Secure configuration management. Standardised firmware and settings align with the secure-build requirements (2.2.3, 2.2.6, 2.2.7).
• Third-party oversight. A clearly defined, contracted access path with a documented, standardised configuration supports the oversight requirements (12.8.1 to 12.8.5).

Loxada gives you deployment-level assurance: which devices are in use, whether they are connected, and which firmware they are running, summarised in a monthly report. That is configuration and deployment assurance rather than logging or monitoring, and for PCI scope reduction it is exactly the kind of evidence that is straightforward to validate and repeat.

The bottom line

PCI DSS compliance is not only about meeting requirements. It is about managing scope. Every uncontrolled access path adds cost, risk and complexity. By standardising off-office access through managed, work-only connections, organisations gain stronger segmentation, simpler evidence and more predictable compliance outcomes. For teams under pressure to reduce audit effort without weakening security, securing the network edge is one of the few changes that delivers both.