{"head":{"title":"What Is PCI Scope? Definition and How to Reduce It","description":"PCI scope is every system, person and process that PCI DSS applies to in your business. What puts systems in scope, how to shrink it and common mistakes.","canonical":"https://oceanlab.in/glossary/pci-scope"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"PCI scope","path":"/glossary/pci-scope"}],"slug":"pci-scope","term":"PCI scope","aka":["PCI DSS scope","scoping"],"category":"Payments and fintech","short":"Every system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.","body":[["The PCI SSC glossary describes scoping as identifying all system components, people and processes to include in a PCI DSS assessment. At the centre is the ",{"href":"/glossary/cardholder-data-environment","text":"cardholder data environment"},": systems that store, process or send card data, plus systems with unrestricted connectivity to them."],["Scope is not fixed. Network segmentation, ",{"href":"/glossary/tokenization","text":"tokenization"}," and handing card entry to a payment provider can all shrink it, which shrinks the number of requirements you must meet."]],"why":["Every system in scope must meet PCI DSS controls and be assessed. A product that lets card numbers touch its own servers, logs or support tools pulls far more into scope than one that never sees them. Scope decides whether you fill in a short ",{"href":"/glossary/saq","text":"SAQ"}," or face a much larger assessment."],"example":["A marketplace first built its own card form that posted to its servers, which put its web servers, logs and database in scope. Moving to the provider's hosted fields means card numbers go straight to the provider, and the marketplace's own systems only ever see tokens."],"inBuild":["PCI scope is set by the payment design in a build: hosted fields or redirect versus own card form, what gets logged, and where tokens are stored. Deciding it early is far cheaper than shrinking scope later."],"mistakes":[["Logging full request bodies that contain card numbers."],["Forgetting support and call-centre tools where staff type card numbers."],["Assuming using a payment provider takes you out of scope entirely. Some requirements still apply."]],"related":[{"href":"/glossary/cardholder-data-environment","label":"Cardholder data environment (CDE)","detail":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them."},{"href":"/glossary/saq","label":"SAQ (self-assessment questionnaire)","detail":"The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment."},{"href":"/glossary/tokenization","label":"Tokenization (payments)","detail":"Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service."},{"href":"/glossary/aoc","label":"AOC (attestation of compliance)","detail":"The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment."}],"tools":[{"href":"/tools/pci-dss-saq-picker","label":"PCI DSS SAQ picker","detail":"Free tool"},{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fee calculator","detail":"Free tool"}],"links":[{"href":"/compliance/pci-dss","label":"PCI DSS guide","detail":"Card data rules and how to shrink your scope."},{"href":"/build/payment-gateway","label":"Building a payment gateway","detail":"Card flows, tokens and PCI scope."},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"sources":[{"title":"PCI Security Standards Council glossary","url":"https://www.pcisecuritystandards.org/glossary/","checkedAt":"2026-10-25"},{"title":"PCI SSC document library (PCI DSS and SAQs)","url":"https://www.pcisecuritystandards.org/document_library/","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}