A regulator asks which systems PCI applies to at a municipal payment processor. What should leadership point to as the durable answer?
Select an answer to reveal the explanation.
Short Explanation
When a regulator asks “which systems?”, “trust us” is not an artifact. A documented PCI entity scope—the named apps and services in that bubble—is the answer you can hand over. Scope turns applicability into a list, not a hallway promise.
Full Explanation
When a regulator asks which systems PCI applies to at a municipal payment processor, leadership should point to a documented PCI entity scope listing the systems and services included for that obligation. Scope turns applicability into a maintainable, reportable list rather than a hallway promise. Verbal assurance from the service desk that “payment stuff is covered” is not an audit artifact. Pointing to the entire CMDB without filters because “PCI always means every CI” over-claims and fails precision. Pointing only to a Policy Statement record title with no entity associations answers with a label, not a system list. Exam caveat: regulatory applicability is operationalized as a defined entity population for the program. Operational check for leadership: maintain a PCI scope register of entities (and related services) with owners and last review date, export or report it from IRM for regulator requests, and update it when architecture changes rather than relying on verbal coverage claims. In civic IRM programs, document the decision, name owners, and verify the platform records match the intended operating model before expanding scope. Re-check after organizational or CMDB changes so evidence remains defensible.