The cardholder data environment (CDE) encompasses all systems, networks, people, and processes that store, process, or transmit cardholder data, or have the ability to impact the security of cardholder data. The CDE includes physical and virtual components such as:
- Payment applications
- Databases
- Web servers
- Network devices
- Any systems connected to them
Organizations must identify and document their CDE boundaries to determine which assets require PCI DSS security controls. Proper CDE segmentation and isolation from other business systems is essential for reducing compliance scope, minimizing risk exposure, and simplifying audit processes.
See also:
