System Components in the cardholder data environment include what?

• A. Only servers and network devices.
• B. Only databases and application software.
• C. Only user workstations.
• D. Any network devices, servers, computing devices, or applications included in or connected to the cardholder data environment.

Answer: (D)

In PCI DSS, the cardholder data environment includes every device and system that stores, processes, or transmits cardholder data, or is connected to those systems. That means the scope covers not just one type of asset but all components that could touch the data or lie on the data path. So it includes any network devices (like routers, switches, firewalls), servers, computing devices (desktops, laptops, mobile devices, virtual machines), and applications that are part of the CDE or connected to it. If a device or software sits in the data flow or is connected through a network path to the CDE, it’s in scope and must be secured accordingly. The other options are too narrow because they exclude other components that can handle or influence cardholder data, such as network gear, various computing devices, or applications connected to the CDE.