Evaluate how cardholder data flows through your organization to determine the appropriate scope of protection. The systems and areas where customer data is stored, processed or transmitted are called cardholder data environments (CDE). PCI DSS compliance is a must for any system that is part of your CDE.