PCI scope
Also called PCI DSS scope, scoping.
Every system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.
Last updated
What it is.
The PCI SSC glossary describes scoping as identifying all system components, people and processes to include in a PCI DSS assessment. At the centre is the cardholder data environment: systems that store, process or send card data, plus systems with unrestricted connectivity to them.
Scope is not fixed. Network segmentation, tokenization and handing card entry to a payment provider can all shrink it, which shrinks the number of requirements you must meet.
Why it matters
Every system in scope must meet PCI DSS controls and be assessed. A product that lets card numbers touch its own servers, logs or support tools pulls far more into scope than one that never sees them. Scope decides whether you fill in a short SAQ or face a much larger assessment.
In a product build
PCI scope is set by the payment design in a build: hosted fields or redirect versus own card form, what gets logged, and where tokens are stored. Deciding it early is far cheaper than shrinking scope later.
Common mistakes.
- 01
Logging full request bodies that contain card numbers.
- 02
Forgetting support and call-centre tools where staff type card numbers.
- 03
Assuming using a payment provider takes you out of scope entirely. Some requirements still apply.
Read the official text.
Primary sources this definition is based on.
- PCI Security Standards Council glossarychecked 2026-10-25
- PCI SSC document library (PCI DSS and SAQs)checked 2026-10-25
Work it out with a tool.
Related terms.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- SAQ (self-assessment questionnaire)The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.
- Tokenization (payments)Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
- AOC (attestation of compliance)The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment.
