A component, as defined on the ASV Scan Report Attestation of Scan Compliance, includes any host, virtual host, IP address, domain, FQDN or unique vector into a system or cardholder data environment.

• A. False
• B. True
• C. Partial
• D. Not Defined

Answer: (B)

In the ASV Scan Report Attestation of Scan Compliance, a component is any element that forms part of or can connect to the cardholder data environment. The definition explicitly includes hosts, virtual hosts, IP addresses, domains, fully qualified domain names (FQDNs), or any unique vector that enters into a system or the CDE. This broad scope ensures that all potential entry points and assets touching the CDE are covered by the scan, not just physical machines. So the statement is true. The other options would imply gaps or ambiguity in what counts as a component, which isn’t how the attestation is defined.