Who reserves the right to mark any host as out of scope?

Who reserves the right to mark any host as out of scope?

• A. The ASV
• B. The client
• C. The merchant
• D. The auditor

Answer: (C)

In PCI DSS, who is allowed to decide what is in scope comes down to who owns and controls the cardholder data environment. If a host is properly isolated behind segmentation and does not store, process, or transmit cardholder data, it can be considered out of scope. That decision rests with the merchant—the entity responsible for the CDE and its security controls. External scanning vendors (ASVs) perform vulnerability scans on systems that are in scope; they don’t determine scope. Auditors verify that the scope is correct, but they don’t unilaterally mark hosts as out of scope. So the merchant reserves the right to mark a host as out of scope when proper segmentation and documentation support it.

In PCI DSS, who is allowed to decide what is in scope comes down to who owns and controls the cardholder data environment. If a host is properly isolated behind segmentation and does not store, process, or transmit cardholder data, it can be considered out of scope. That decision rests with the merchant—the entity responsible for the CDE and its security controls. External scanning vendors (ASVs) perform vulnerability scans on systems that are in scope; they don’t determine scope. Auditors verify that the scope is correct, but they don’t unilaterally mark hosts as out of scope. So the merchant reserves the right to mark a host as out of scope when proper segmentation and documentation support it.