Explains PCI DSS scope
The cardholder data environment: every system that stores, processes or transmits cardholder data, and the systems connected to it; a copy of the PAN brings its store, jobs, users and backups into scope.
Can AI do this?
AI does this well Most of the tested AI models master this. 3 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 99% | Mastered |
| gemini-3.5-flash-lite | Low cost | 92% | Not shown |
| gpt-6-luna | Low cost | 100% | Mastered |
| claude-haiku-5-5 | Low cost | 100% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The cardholder data environment: every system that stores, processes or transmits cardholder data, and the systems connected to it; a copy of the PAN brings its store, jobs, users and backups into scope.
How it is assessed: Answers a written question on the PCI DSS scope correctly
Related knobits
Builds on
Needed for
- S-108 Recognises regulated data outside its requirement's scope
- S-131 Traces the scope consequence of a regulated data copy
- S-201 Recognises a card number not classified as cardholder data
All 17 knobits of Register regulatory security requirements.
Source: Practice the stage 1 reference and review checklist rest on