PCI SSCPCI DSSScoping SegmentationEASYFree question
How do cardholder data flow diagrams support scoping?
- A.They list all encryption keys and their custodians, directly proving that key management meets Requirements 3.6 and 3.7
- B.They identify all systems, networks, and processes that handle cardholder data, directly defining what is in scope
- C.They record all firewall rules and the business reason for each one, directly replacing the semiannual rule review under Requirement 1.2.7
- D.They document all employee access rights and approvals, directly satisfying the quarterly user account review requirement
Why B is correct
Data flow diagrams trace cardholder data through the environment, identifying every system that stores, processes, or transmits it, which directly defines the CDE scope.
Know someone studying for PCI DSS? Send them this one.