Which areas are defined as sensitive in PCI DSS context?

• A. Public-facing retail cashier areas only
• B. Hallways and lobbies
• C. Only external network closets
• D. Any data center, server room, or area housing systems that store, process, or transmit cardholder data

Answer: (D)

In PCI DSS, sensitive areas are defined by where cardholder data is stored, processed, or transmitted. The option that describes any data center, server room, or area housing systems that store, process, or transmit cardholder data aligns with this idea because those spaces actually contain the components and data flows that handle CHD, and thus require strict access controls and physical protections. Public-facing spaces like hallways or lobbies aren’t by themselves defined as sensitive unless they contain CHD-handling systems, and external network closets don’t automatically qualify unless they house devices that store or process CHD. The key concept is focusing on locations that actively store, process, or transmit cardholder data, not just any area.