Cardholder data environment (CDE)
Also called CDE.
The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
Last updated
What it is.
PCI DSS, the security standard for payment card data, uses the CDE to mark what is in scope. Card numbers and sensitive authentication data define the core. Any system that can reach those systems, such as a shared network, an admin laptop or a logging server, is pulled into scope too unless it is properly segmented.
The PCI Security Standards Council publishes the standard, its glossary and the self-assessment questionnaires (SAQs) that smaller merchants use to report compliance.
Why it matters
The size of your CDE drives most of the PCI DSS work. Keeping card data out of your own systems, for example with a hosted payment page, an iframe from the payment provider or tokenization, shrinks the CDE and can move you to a much shorter SAQ. That is a design decision best made before the build, not after.
Common mistakes.
- 01
Logging full card numbers by accident in error logs or analytics events.
- 02
Forgetting connected systems. Anything that can reach the CDE can be in scope.
- 03
Assuming a PCI-compliant payment provider makes your whole app compliant. Your part still has requirements.
Read the official text.
Primary sources this definition is based on.
- PCI Security Standards Council glossarychecked 2026-10-25
- PCI SSC document library (PCI DSS and SAQs)checked 2026-10-25
Work it out with a tool.
Related terms.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
- SOC 2 Type IIAn independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- Guardrails (AI)Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs.
Guides and pages
Browse the full glossary or read answers to common questions.
