Which process identifies all system components, people, and processes to be included in a PCI DSS assessment?

• A. System Development Life Cycle
• B. Scoping
• C. Security Policy
• D. Secure Coding

Answer: (B)

Scoping identifies all system components, people with access, and processes that must be included in a PCI DSS assessment. It sets the boundaries of what is in the Cardholder Data Environment, ensuring anything that stores, processes, or transmits cardholder data—or could affect its security—is considered. This focus on boundaries and inclusions is essential because the PCI DSS requirements apply to what falls inside scope, and accurate scoping prevents gaps and unnecessary work. The other concepts describe different things: a System Development Life Cycle outlines how systems are planned and built, a Security Policy establishes governance rules, and Secure Coding deals with secure software development practices.