Knowledge center

What does scope mean in PCI DSS?

Scope includes the people, processes, technologies, locations and providers that store, process or transmit card data, plus components that can affect its security.

Why it matters

A scope that is too broad creates unnecessary work; one that is too narrow can omit relevant systems or responsibilities.

What to confirm

Where card data flows
Systems, networks, people and locations
Third parties and connections

Official PCI DSS documentation · PCI DSS v4.0.1 · reviewed 2026-07-29

This content is informational and is not legal advice. The applicable route and validation method depend on the operation and requesting party.

Explore your likely route Back to all questions