What Is the Cardholder Data Environment (CDE)? PCI DSS Scoping Guide

Scoping Categories

Illustrative categories from the Scoping and Network Segmentation Guidance:

1. CDE systems - store, process, or transmit account data (or have unrestricted connectivity as defined in the glossary)
2. Connected-to and/or security-impacting systems - have a path to the CDE or can impact CDE security (for example authentication servers, jump hosts, or network security controls managing the CDE)
3. Out of scope - must meet all out-of-scope criteria and none of the higher categories; cannot impact CDE security even if compromised

Annual Scope Confirmation

At least annually and before assessment, the entity confirms scope (all CHD locations and flows; systems connected to the CDE or that could impact the CDE if compromised) and retains documentation. The assessor validates that scope was accurately defined. The entity keeps scope accurate on an ongoing basis.

How CyberSilo Helps

• Continuous inventory and diagram evidence
• ThreatHawk SIEM visibility into CDE-adjacent traffic
• CSA mapping of in-scope components to requirements

Frequently Asked Questions

Is encryption enough to take a system out of scope?

Encrypted CHD that coexists with keys, or is accessible to an entity that also has the keys, generally remains in scope considerations per PCI DSS encrypted-data notes. Tokenization, P2PE, and outsourcing are separate strategies - see the scope reduction guide.

Are people "in the CDE" for segmentation?

People who handle CHD are part of the CDE conceptually. Scoping Guidance notes people need not be physically segmented from non-CDE people if access controls enforce CDE-only access.

Who confirms scope - us or the QSA?

You define and document annually; the assessor validates the definition for the assessment.

Related PCI Resources

Scope reduction · Segmentation testing · SAQ types · Requirement 1 · Merchants vs service providers