The PCI DSS security requirements apply to all system components included in or connected to an organisation’s cardholder data environment (CDE). The CDE encompasses all people, processes and technologies that store, process, or transmit cardholder and sensitive authentication data.
PCI DSS can apply across the whole of an organisation, or to a subset of it if the CDE has been correctly compartmentalised. System components in scope include network devices, servers, computing devices, and applications.