The Cardholder Data Environment (CDE) comprises which of the following?

• A. The people who handle cardholder data.
• B. The processes used to manage cardholder data.
• C. The people, processes and technology that store, process, or transmit cardholder data or sensitive authentication data.
• D. Only the technology used to encrypt data.

Answer: (C)

Defining what the Cardholder Data Environment encompasses is about scope. The CDE includes the people, the processes, and the technology that store, process, or transmit cardholder data or sensitive authentication data. This broad view matters because security controls must cover every facet involved in handling CHD/SAD, from who has access, to how data is managed, to the systems and networks that carry or store it. If you focus on only one piece—just people, or just processes, or just technology—you miss other areas that can introduce risk. For example, encryption technology alone doesn’t address how data is handled by staff or the procedural steps that govern data flow. So the most accurate understanding is that the CDE comprises the people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data.