Which diagram must exist to map cardholder data flows across systems and networks?

Which diagram must exist to map cardholder data flows across systems and networks?

• A. An outdated diagram that only shows external connections.
• B. A diagram of security controls without data flow details.
• C. A high-level diagram of network topology without data flows.
• D. Current diagram that shows all cardholder data flows across systems and networks.

Answer: (D)

Mapping the exact paths cardholder data takes through your environment is essential. A current diagram that shows all cardholder data flows across systems and networks ensures you can see every route where data travels, every system that processes or stores it, and every pointing point where controls must be applied or monitored. This full, up-to-date view supports effective risk assessment, proper segmentation, and the placement of security measures exactly where data moves, not just where you think it might. An outdated diagram that only shows external connections misses internal data paths, so it can leave risks hidden. A diagram of security controls without data flow details doesn’t reveal how data travels or which controls protect each path. A high-level diagram of network topology without data flows fails to show the actual routes cardholder data takes, making it impossible to verify proper coverage. Only the current diagram that explicitly shows all cardholder data flows across systems and networks provides the actionable view needed to protect the data end-to-end.

Mapping the exact paths cardholder data takes through your environment is essential. A current diagram that shows all cardholder data flows across systems and networks ensures you can see every route where data travels, every system that processes or stores it, and every pointing point where controls must be applied or monitored. This full, up-to-date view supports effective risk assessment, proper segmentation, and the placement of security measures exactly where data moves, not just where you think it might.

An outdated diagram that only shows external connections misses internal data paths, so it can leave risks hidden. A diagram of security controls without data flow details doesn’t reveal how data travels or which controls protect each path. A high-level diagram of network topology without data flows fails to show the actual routes cardholder data takes, making it impossible to verify proper coverage. Only the current diagram that explicitly shows all cardholder data flows across systems and networks provides the actionable view needed to protect the data end-to-end.