Which of the following defines a Sensitive Area?

• A. Any data center, server room or area that houses systems that store, process, or transmit cardholder data.
• B. Cashier areas where only POS terminals are present
• C. Public areas with no cardholder data
• D. Server racks in a non-secure location

Answer: (A)

A Sensitive Area is the physical space that houses systems which store, process, or transmit cardholder data. This definition targets where the Cardholder Data Environment resides and where access should be tightly controlled and monitored. The best choice directly matches this idea by specifying data centers, server rooms, or any area that contains those CHD-holding systems. Areas that lack CHD data, or locations that don’t actually house the processing or storage infrastructure (even if they contain some terminals), aren’t considered sensitive areas. A non-secure location with server racks isn’t suitable either, because the key factor is that the area houses the systems that handle CHD and is properly protected.