PCI SSCPCI DSSScoping SegmentationEASYFree question
How do cardholder data flow diagrams support scoping?
- A.They are optional for scoping
- B.They identify all systems, networks, and processes that handle cardholder data, directly defining what is in scope
- C.They only show network topology, listed in Requirement 1.2.1 as part of the configuration standard for network security controls
- D.They are not related to scoping, because anti-spoofing measures were withdrawn from Requirement 1 in version 4.0 as redundant with TLS
Why B is correct
Data flow diagrams trace cardholder data through the environment, identifying every system that stores, processes, or transmits it, which directly defines the CDE scope.
Know someone studying for PCI DSS? Send them this one.