Where should system components that store cardholder data be placed?

Where should system components that store cardholder data be placed?

• A. Place CHD components in the DMZ.
• B. Place system components that store cardholder data in an internal network zone segregated from the DMZ and other untrusted networks.
• C. Place CHD components on the Internet.
• D. Place them on user devices.

Answer: (B)

Keeping cardholder data storage inside an internal, segregated network zone is essential. This placement creates a trusted boundary that is isolated from untrusted networks (like the DMZ and the Internet) and from user devices. By doing so, you limit who can access the data, enable tighter access controls and monitoring, and help ensure stronger protection for the sensitive information. Placing CHD components in the DMZ, on the Internet, or on user devices would expose the data to greater risk and undermine the segmentation that reduces exposure and supports compliant, secure handling.

Keeping cardholder data storage inside an internal, segregated network zone is essential. This placement creates a trusted boundary that is isolated from untrusted networks (like the DMZ and the Internet) and from user devices. By doing so, you limit who can access the data, enable tighter access controls and monitoring, and help ensure stronger protection for the sensitive information. Placing CHD components in the DMZ, on the Internet, or on user devices would expose the data to greater risk and undermine the segmentation that reduces exposure and supports compliant, secure handling.