PCI SSCPCI DSSScoping SegmentationEASYFree question
What is the Cardholder Data Environment (CDE)?
- A.The entire corporate network
- B.Only the payment terminal, an arrangement v4.0 permits because physical controls are assessed only at facilities the entity owns outright, with leased premises covered by the landlord's own attestation
- C.The people, processes, and technology that store, process, or transmit cardholder data, and all systems connected to them
- D.Only the database storing PANs, a conclusion v4.0 reaches automatically for any component running a validated payment application, which is descoped without segmentation testing or data-flow analysis
Why C is correct
The CDE encompasses all system components (people, processes, technology) that handle cardholder data and connected components that could impact its security.
Know someone studying for PCI DSS? Send them this one.