Simplify PCI DSS Compliance with Network Segementation for Remote Staff
Loxada makes it easy to enforce PCI DSS network segmentation outside the office, securing remote and hybrid teams without complex setups.
The Problem
The Payment Card Industry Data Security Standard (PCI DSS) mandates strict network controls and segmentation between systems that handle cardholder data and those that don’t to avoid an organisation’s entire IT being in scope. In office environments, implementing this is relatively straightforward. But what happens when staff work remotely?
In many organisations, customer service agents, finance teams, or fraud investigators access payment data from home offices, temporary setups, or serviced locations. These environments often rely on off-the-shelf routers that are unmanaged, unmonitored, and potentially unpatched.
Even where VPNs or remote desktops are used, the local network may still present a risk. A compromised or poorly configured home router could allow lateral movement, traffic sniffing, or spoofed DNS even before the secure session is initiated.
PCI DSS v4.0 explicitly requires that network segmentation is maintained to isolate the Cardholder Data Environment (CDE). Without proper segmentation, the remote user’s network becomes part of the CDE, exponentially increasing audit scope and exposure.
Loxada’s Solution
Loxada enables simple, device-enforced network separation that supports PCI DSS compliance, especially for remote and hybrid staff.
Each Loxada router creates a secure, hardened corporate network regardless of the local infrastructure it connects to. Devices connected to the Loxada network are completely isolated from the surrounding environment, ensuring they remain separate from unknown, potentially vulnerable systems.
Key benefits include:
- Hardware-level segmentation
- Ensures devices accessing cardholder data are shielded from all other devices on the local network
- Always-on VPN connectivity
- All traffic is routed through Loxada’s secure tunnel to approved endpoints, with no reliance on user configuration
- Tamper resistance and central control
- Devices cannot be modified locally and always revert to a secure default if reset. IT teams maintain control via subscription and cannot be bypassed by the user
- Consistent policy enforcement
- Whether staff are at home, travelling, or working from a secondary site, network access behaviour remains predictable and auditable
This approach satisfies the intent of PCI DSS network segmentation without the cost or complexity of managing firewalls, VLANs, or agent-based software across unknown networks.
Benefits and Use Cases
Loxada offers an efficient and cost-effective solution to meet PCI DSS network segmentation requirements, particularly for remote workers or distributed teams.
Practical use cases include:
- Customer service agents handling card data remotely
- Maintaining CDE boundaries even when staff are working from unmanaged networks
- Back-office finance teams in hybrid setups
- Ensuring data remains protected, whether users are in the office or at home.
- Retail operations staff connecting from shared offices
- Isolating critical systems even in environments with shared or outsourced network infrastructure
- Call centres using BYOD or temporary staff
- Providing a consistent access layer without needing to reconfigure personal networks
By creating a consistent, isolated environment for handling payment data, Loxada helps organisations avoid unnecessarily expanding their CDE, saving time, cost, and audit scope.
Why It Matters for PCI DSS v4.0
Version 4.0 of the PCI DSS introduces a greater focus on flexibility and custom controls while also increasing expectations around secure access and segmentation.
Requirements that Loxada directly supports include:
- Requirement 1.2.1 & 1.2.3: Maintain and document network segmentation for the CDE
- Requirement 3.6.1: Use secure transmission mechanisms for sensitive data
- Requirement 5.3.1: Control access to system components based on role and context
- Requirement 12.3.1: Establish formal risk assessment procedures for remote access
By using Loxada, organisations gain a clear, repeatable control that can be documented and demonstrated to assessors. It reduces audit burden, minimises the attack surface, and enforces consistent behaviour, regardless of the user’s location.
Unlike software-only solutions, it eliminates reliance on local infrastructure, user awareness, or third-party ISP routers, offering stronger, simpler compliance.