In PCI DSS, what term is used to refer to the corporation, organization, or business undergoing the review?

• A. Asset
• B. Entity
• C. Network Segment
• D. Participant

Answer: (B)

In PCI DSS, the organization undergoing the review is referred to as the entity. This term designates the whole organization—whether a merchant or a service provider—that is subject to the PCI DSS assessment and responsible for the cardholder data environment. The focus is on the entity as the accountable body that defines the scope, implements controls, and coordinates with any third parties involved.

Assets describe individual resources like servers or databases, not the organization itself. A network segment is a portion of the network used for boundary and data flow control, not the organization. A participant isn’t a standard term used to label the reviewing entity in PCI DSS.

So, the entity is the best fit to describe the corporation, organization, or business undergoing the review.