Cardholder data environment (CDE): PCI scope and how to shrink it

What is a cardholder data environment?

The cardholder data environment is the people, processes and systems that store, process or transmit payment card data, plus anything connected to them. Under PCI DSS, everything in it is in scope for assessment.

The CDE (a PCI DSS term) is usually far bigger than the payment system itself, which is why so much PCI work goes into making it smaller.

Cardholder data definition

Cardholder data is the primary account number, the long number on the card, plus the cardholder name, expiry date and service code when they are stored with it. Sensitive authentication data, such as the card security code and the PIN, must never be stored after a payment is authorised.

Network segmentation for PCI

Systems that can connect to the CDE are pulled into scope too. Segmentation isolates the CDE with firewalls and access controls so the rest of the network cannot reach it, which takes everything else out of scope. PCI DSS does not require segmentation, but if you rely on it to reduce scope, it has to be tested.

How to reduce PCI scope

  • Do not store card numbers you do not need.
  • Use a payment provider’s hosted payment page or fields, so card data never touches your servers.
  • Use tokens in place of card numbers in your own systems.
  • Segment whatever must stay in scope from everything else.

PCI scope and your readiness

The smaller the CDE, the fewer controls and the less evidence you need. Compliance as a Service for SMBs tracks PCI DSS alongside SOC 2, HIPAA and GDPR, so a company handling card data sees its readiness for each standard from the same evidence.

Last reviewed 2026-11-01.

Related terms

  • Control — A security control is a specific safeguard a company puts in place to manage a risk, such as revoking a leaver’s access within 24 hours, and that an auditor can ask you to prove is working.
  • Evidence — Compliance evidence is the record that proves a control actually operated: a log export, a signed policy, a closed ticket, a dated screenshot.
  • Readiness assessment — A readiness assessment is a rehearsal of an audit: a review of your controls, policies and evidence against a framework such as SOC 2, done before the real audit so gaps can be fixed while it is still cheap.

All glossary terms →