Data Flow Diagram

Applies to. Under PCI DSS the data-flow diagram is about account data specifically: where it enters, every system that stores, processes or transmits it, and where it leaves to acquirers, processors or other third parties. 1.2.4 requires it to be accurate, to show all account data flows across systems and networks, and to be updated as the environment changes, and 12.5.2 has the entity update it as part of confirming scope. Assessors read it alongside the network diagram; 1.4.4.a, for instance, checks the data-flow diagram to confirm that systems storing cardholder data have no direct path from an untrusted network.

Example. A retailer takes payments in store, by phone and online. Its data-flow diagram shows card data entering at the POS terminal and going encrypted to the processor, phone orders being keyed into a virtual terminal by staff, and web orders posting to a hosted payment page. When the phone team starts writing card numbers on paper before keying them, the diagram has to change, and so does the scope.

Limits. A data-flow diagram is not a network diagram. The network diagram shows connections between systems and where NSCs sit; the data-flow diagram shows what account data does as it moves. Both are needed, and one cannot stand in for the other. A diagram that shows only the website flow while the entity also takes card numbers by phone leaves a channel out and understates scope. It also does not by itself prove that the flows shown are the only ones; that is what scope validation and the assessor's own review confirm.