Entity maintains an inventory of system components that are in scope for PCI DSS and has access to cardholder data