System Component
Also: System Components
PCIComplianceHubLast updated
Any network device, server, computing device, virtual component, cloud component or piece of software that sits within the cardholder data environment or is connected to it. The term matters because PCI DSS requirements apply per system component, so what counts as one directly determines the size and cost of an assessment. Virtual machines, containers, hypervisors, cloud services and serverless functions are all system components, and the inventory of them required by Requirement 12.5.1 is the foundation of accurate scoping.
Applies to. Requirements 1 to 11 are written against system components, so each one must be found and treated. 12.5.1 requires a current inventory of every in-scope component with its function, and 12.5.2 requires the scope review to identify all components in the CDE, connected to it, or able to affect its security. Examples of per-component obligations in the standard: configuration standards must cover all system components (2.2.1), anti-malware goes on all of them unless a periodic evaluation under 5.2.3 shows a component is not at risk (5.2.1), and security patches are installed on all of them (6.3.3).
Example. A supermarket chain's in-scope components include the store payment switch, the directory server that authenticates administrators to it, the jump host used for remote support, the log collector that receives its logs, and the virtual host the switch runs on. Its HR system on a separately segmented network with no route into the CDE is out of scope, and 12.5.2 requires the justification for that to be written down.
Limits. System component is wider than 'system that handles card data': a server that never sees a PAN is still a system component if it is connected to the CDE or could affect its security, such as a directory, patching or logging server. People and business processes are in scope for an assessment but are not system components. The term is not the same as an asset register entry; a component kept out of scope through verified segmentation is still an asset but is not counted for PCI DSS. Virtual and cloud elements count as components even when a third party runs the underlying hardware.