If you run retail in Edmonton with payment terminals on Wi-Fi or with any wireless network in proximity to your point-of-sale environment, PCI-DSS applies to you. The standard has specific requirements for wireless that are stricter than the wired equivalent because wireless leaks beyond your physical premises. This post walks through PCI-DSS Edmonton retail WiFi requirements, what auditors actually check at Edmonton locations, and what we see retailers get wrong.

The short version. PCI-DSS requires you to (1) inventory and authorize every wireless access point in or near your CDE, (2) scan quarterly for rogue access points, (3) isolate any wireless that touches the CDE from guest and corporate Wi-Fi with firewall enforcement, (4) use strong encryption (WPA2-Enterprise minimum, WPA3 preferred), and (5) monitor wireless intrusion attempts. None of this is exotic. The challenge is doing it consistently across multiple retail locations.

Why retail Wi-Fi is different from corporate Wi-Fi

Three things make retail wireless uniquely scrutinized under PCI. First, payment terminals are often connected wirelessly for layout flexibility, which puts the wireless network directly in scope of the cardholder data environment (CDE). Second, retail locations have public spaces, so any wireless signal could be captured from a parking lot or the storefront across the street. Third, retail staff turnover is high, which creates ongoing access management challenges.

The PCI Wireless Guideline document is explicit. Wireless that carries cardholder data, or that is connected to the network where cardholder data lives, must meet the same baseline controls as the wired CDE plus additional wireless-specific controls. The cardholder data environment.

What auditors actually check

From PCI assessments we have supported at Edmonton retail clients, the consistent themes are these.

An inventory of every wireless access point at every location, with documentation of who authorized it. Quarterly rogue AP scans documented with date, scope, and findings. Network diagrams showing the CDE Wi-Fi isolated from guest Wi-Fi with firewall enforcement. Wireless encryption configured to WPA2-Enterprise minimum (with 802.1X authentication, not pre-shared keys) for any network in scope. Logs from wireless controllers retained for at least 90 days. Evidence that the segmentation has been tested by attempting to reach the CDE from guest Wi-Fi and being blocked.

Auditors do not require any specific brand of wireless or any specific commercial product. They require evidence that the controls actually work as documented.

PCI-DSS reference architecture for retail Wi-Fi showing CDE isolation, guest network separation, and rogue AP detection

A reasonable baseline for an Edmonton retail location

1. Inventory and authorize every AP

Document every wireless access point at every location. SSID, channel, MAC, location within the store, who authorized it, when. Update whenever a new AP is added.

2. Separate guest, corporate, and CDE Wi-Fi

Three SSIDs minimum, on three separate VLANs, with firewall enforcement between them. Guest Wi-Fi has internet only, no access to corporate or payment networks. Corporate Wi-Fi has access to internal systems but not the CDE. CDE Wi-Fi is restricted to authorized payment terminals only.

3. Use WPA2-Enterprise (or WPA3) for any in-scope network

Pre-shared keys (PSK) do not pass PCI for in-scope networks because shared keys cannot be revoked when staff leave. Use 802.1X with RADIUS so each device or user has its own credential. WPA3 is acceptable and increasingly the default on new equipment.

4. Quarterly rogue AP scanning

At each location, scan for unauthorized APs every quarter. Most enterprise wireless controllers do this automatically. For smaller installations, a handheld wireless analyzer (Ekahau, NetSpot, or similar) used during a routine site visit is enough. Document each scan.

5. Wireless intrusion monitoring

Wireless IDS/IPS that alerts on attempts to associate with the CDE Wi-Fi from unauthorized devices, or attempts to spoof your SSIDs. Most enterprise wireless controllers include this functionality.

6. Documentation and annual test

Network diagrams kept current. Annual penetration test that specifically attempts to reach the CDE from non-CDE wireless. Evidence retained for the audit.

Common audit findings at retail locations

From assessments we have seen, six findings repeat. First, single SSID with PSK shared across all staff for both POS and personal device use. Second, guest Wi-Fi on the same VLAN as POS terminals because the consumer-grade router from years ago could not segment. Third, no rogue AP scanning, often because nobody owns the function in a multi-location retail operation. Fourth, wireless controllers not retained logs long enough, often defaulting to 30 days when 90 is required. Fifth, no documented inventory of APs across locations, so a recently added franchise location’s wireless is invisible to compliance. Sixth, payment terminals using outdated wireless protocols (WEP, WPA-PSK) that fail PCI on encryption strength alone.

Top six PCI-DSS Wi-Fi audit findings at retail locations and how each is remediated

What the official guidance does not emphasize

PCI Wireless Guideline tells you to scan for rogue APs but rarely emphasizes that rogue APs at retail locations are often introduced by well-meaning staff (a personal hotspot, a consumer router brought in to extend coverage). The fix is not just scanning. It is also a clear staff policy that no personal wireless devices may be brought into the back office, and ideally a wireless intrusion system that alerts on new SSIDs appearing in the location’s RF space.

Also, PCI-DSS 4.0 (effective in 2025 for new compliance cycles) raises the bar on multi-factor authentication for system component access. If your wireless management is accessed from outside the CDE, MFA on the controller is now expected.

FAQ

Does PCI apply if we use a third-party POS that handles payment?

It depends on the deployment. If the POS handles cardholder data on your network, even temporarily, PCI applies. If the POS is a fully outsourced cloud service that processes cards via the cloud and never touches your network, scope reduces. Get this scope documented explicitly.

Can I share one wireless controller across CDE and guest Wi-Fi?

Yes, as long as VLAN separation and access controls are enforced. The controller itself is not the issue, the configuration is.

Is captive portal enough for guest Wi-Fi?

Captive portal handles user agreement, but the security comes from VLAN isolation and firewall enforcement. Captive portal alone does not satisfy PCI segmentation requirements.

Audit coming up at your retail location

If you have a PCI assessment scheduled and you operate retail Wi-Fi at one or more Edmonton locations, our team does focused PCI Wi-Fi readiness assessments that produce a per-location gap report. Tell us your locations and we will scope a quick readiness review.

Last verified April 2026 by the aaanetworkx compliance practice.

PCI-DSS Edmonton Retail WiFi: Compliance Guide 2026