Which term is used to describe the initial step of identifying the scope for a PCI DSS assessment?

Which term is used to describe the initial step of identifying the scope for a PCI DSS assessment?

• A. Security Policy
• B. Schema
• C. Secure Wipe
• D. Scoping

Answer: (D)

Scoping is the process of identifying what parts of the environment are in scope for PCI DSS. This is the first step because you must map which systems store, process, or transmit cardholder data (and which systems can affect the security of those systems) to determine which controls apply. By outlining data flows and boundaries, you ensure the assessment focuses on the right assets and covers all cardholder data pathways. Security policy governs security requirements and governance, but it doesn’t by itself define which assets are in scope. Schema is a data model concept, not about scope. Secure wipe is about sanitizing data after disposal, not identifying scope. So, the initial step is scoping.

Scoping is the process of identifying what parts of the environment are in scope for PCI DSS. This is the first step because you must map which systems store, process, or transmit cardholder data (and which systems can affect the security of those systems) to determine which controls apply. By outlining data flows and boundaries, you ensure the assessment focuses on the right assets and covers all cardholder data pathways. Security policy governs security requirements and governance, but it doesn’t by itself define which assets are in scope. Schema is a data model concept, not about scope. Secure wipe is about sanitizing data after disposal, not identifying scope. So, the initial step is scoping.