Clear boundaries before work starts
Findings, scoped network changes and a recovery plan. Your payment attestation stays yours.
Scope of this work
Scope of this work. Torrey Line LLC's services are limited to the business-network tasks listed in the signed scope. We do not assess, certify, access or modify payment terminals, payment applications, or systems that store, process or transmit cardholder data. This is a network / POS assessment, not a PCI DSS assessment or certification. Segmentation is one control among many and is not a promise of compliance or freedom from breach. The merchant remains responsible for completing and signing any attestation with its payment processor. If proposed work affects the cardholder-data environment or requires access to an excluded system, we stop that work, ask the merchant to obtain scope direction from its processor or acquirer, and refer the excluded work to the appropriate provider. A revised scope may remove or narrow tasks; it can never authorise us to assess, certify, access or modify an excluded system. This boundary describes what we do and do not do. It does not determine technical PCI scope, and it does not limit our responsibility for our own conduct.
Network equipment affecting payment connectivity can itself be within PCI scope. A written exclusion does not decide that scope or remove responsibility for our own work. Processor or acquirer direction is needed before accepting payment-network work.
If your needs extend beyond these boundaries, we agree a referral before proceeding. Ask about your proposed scope.