Network Diagram
PCIComplianceHubLast updated
A diagram showing the system components in a networked environment and the connections between them. PCI DSS requires an accurate one showing every connection between the CDE and other networks, and it is usually the first document an assessor asks for.
Applies to. Every entity. It is required by 1.2.3 and is the basis of the scope confirmation in 12.5.2.
Example. A diagram that shows the payment segment, its firewalls, the office network, the wireless network, the VPN to the processor and the monitoring server that reaches into the segment. A diagram that shows only the payment segment is not showing the connections the control asks for.
Limits. The control is about accuracy as much as existence: 1.2.3 says accurate and kept current, and an assessor will compare it to firewall rules and to what discovery finds. It is distinct from the data-flow diagram in 1.2.4, which shows where account data goes rather than what connects to what; both are required. A diagram that omits a connection has usually omitted a system from scope.