A restaurant group cuts its PCI DSS scope with P2PE terminals, tokenized online ordering and segmented store networks
A restaurant group with 19 locations in Florida and Georgia and about 900 employees, a leader in its segment.
- Scale
- 19 restaurants, about 85 payment terminals, 1 online ordering site, 4 network zones per location, 1 hosted payment page, 17 locations on the lightest self-assessment questionnaire after rollout
- Engagement
- Eight weeks of scoping and design, a pilot at two restaurants, then about four months to convert the remaining locations
The challenge
Card readers at every restaurant plugged into the point-of-sale computers, so card numbers passed through the same machines, the same store network and, for tips and refunds, the same back-office reports as everything else. Kitchen display screens, the manager's laptop, guest Wi-Fi and the music system shared that network. Online ordering ran on a plugin that collected card numbers on the group's own web server before passing them to the processor. The group's acquirer asked for a full self-assessment questionnaire covering all of it, and the answers to many questions were guesses, because nobody had mapped where card data actually went.
Restaurant groups tend to inherit their payment setup one location at a time: a terminal vendor at one site, an ordering plugin added for another. The first useful session was a drawing exercise. We sat the finance director, the operations lead and the person who runs the point-of-sale system at one table and asked them to follow a single card from the guest's hand to the bank, on every channel. Where they disagreed, the map had found a gap.
The design rests on one idea: the fewer systems that ever see a card number, the fewer systems the assessment has to cover. PCI DSS applies to anything that stores, processes or transmits card data, and to everything connected to it. When the terminal encrypts the card at the moment it is read and only the solution provider can decrypt it, the point-of-sale computers and the store network stop being part of that data path. The group still has duties, such as inventorying devices and following the provider's instructions, but the list gets much shorter.
We piloted at two restaurants before touching the other 17. A pilot is where the unglamorous problems appear: a bar-tab workflow that needed a different terminal model, tip adjustments that the new setup handled differently, and a manager who wanted to key in a card over the phone. Each one was settled with the operations team and written into the manager guide, not left to the person at the register.
Scope reduction is not a certificate. The acquirer and the card brands decide which questionnaire applies, and the group still has to prove its terminals are intact, its checkout page scripts are controlled and its networks are separated. The value of this kind of project is that those proofs are small, repeatable and owned by a named person. In this illustrative case, two locations stayed outside the simple path for a quarter, and the report says so plainly.
What our team delivered
- A card-data flow map for each channel, built by tracing real transactions: dine-in terminals, bar tabs, takeout, gift cards, the online ordering site and the delivery marketplaces. It showed three places where card numbers touched group systems, and that the delivery marketplaces take their own payments and leave nothing to the group but the order
- Replacement of the integrated readers with payment terminals that are PTS-approved point-of-interaction devices and run a point-to-point encryption (P2PE) solution listed as validated by the PCI Security Standards Council. The terminal encrypts the card at the swipe, tap or dip, and the point-of-sale computer receives only the result and a receipt. The solution provider holds the decryption keys, and the group never does
- A written responsibility matrix from the P2PE provider and the processor, showing which requirements the provider meets, which the group meets and which it shares. Terminals are inventoried by serial number, inspected on a schedule for tampering and skimmers, and a missing or swapped device is reported the same day
- Online ordering moved to the processor's hosted payment fields, which display in a frame served from the processor's domain, so card numbers go straight from the customer's browser to the processor and the group's server receives a token. The group stores tokens for repeat orders, not card numbers. The checkout page's scripts are inventoried and limited to a short approved list, with a content security policy and integrity checks for the ones the group controls
- Four zones on every store network: payment terminals, point-of-sale and kitchen systems, staff and back office, and guest Wi-Fi, each its own VLAN with default deny between them. Terminals can reach only the P2PE provider and the processor on named ports, and guest Wi-Fi has no route to anything but the internet. Segmentation was kept even where it was no longer required for scope, since a clean network is still a safer one
- A purge of historical card data: reports, receipts, email attachments and old database backups were searched with a card-number detector, and 6 locations had full card numbers in end-of-day exports. The exports were changed to print only the first six and last four digits at most, the old files were securely deleted and the finding was written up for the acquirer
- A short guide for managers on what staff should never do: type a card number into a computer, photograph a card or take one over the phone into a note. Phone orders go through a terminal in the office, or a payment link the guest completes
- Evidence kept for the annual assessment: the data-flow map, the provider's listing and agreement, the terminal inventory and inspection log, the segmentation test results, the script inventory for the checkout page and the quarterly external vulnerability scans required for the online site
Result
The group moved 17 of its 19 locations to the self-assessment questionnaire for validated P2PE solutions, which covers far fewer requirements than the full one, and its online ordering to the questionnaire for fully outsourced payment pages. The other 2 locations kept an older bar-tab integration whose terminal model is not on the provider's list, so they were assessed separately until the terminals were replaced in the following quarter. After the rollout, a card-number search found no card data on any point-of-sale computer, the back office or the web server, and a test from guest Wi-Fi reached none of the terminals. Which questionnaire applies, and what the group must validate, is decided by the acquirer and the card brands, and a P2PE solution does not cover online orders or phone-taken cards. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 2 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.