All systems that store, process, or transmit cardholder data - All systems connected to the CDE - All network segments connected to the CDE - All systems providing security services to the CDE (firewalls, IDS/IPS, authentication servers)