Maintaining PCI DSS Compliance and a Secure Network: Are Your Network Diagrams Up-to-Date?

The PCI DSS outlines what you need to include in your diagrams.

Keep in mind, your diagram must show ALL connections between your CDE and all other networks, including wireless.

Best practice: Get everyone connected to the network diagram on the same page for keeping it current and accurate!

You must identify the following:

• All connections to and from all system components in the CDE, including
  • Systems providing security services
  • Systems providing management services
  • Systems providing maintenance services
• The network diagram should also include the following:
  • All locations, including retail locations, datacenters, corporate locations, cloud providers,etc.
  • Clear labeling of all network segments
  • All security controls providing segmentation, including unique identifiers for each control (for example, name of control, make, model, and version).
  • All in-scope system components, including
    • NSCs
    • web app firewalls
    • anti-malware solutions
    • change management solutions
    • IDS/IPS
    • log aggregation systems
    • payment terminals
    • payment applications
    • HSMs, etc
• Clear labeling of any out-of-scope areas on the diagram via a shaded box or other mechanism.
• Date of last update, and names of people that made and approved the updates.
• A legend or key to explain the diagram.
• Diagrams should be updated by authorized personnel to ensure diagrams continue to provide an accurate description of the network.

Did you catch all those “all” statements?

Unfortunately, that word “all” gets overlooked all. the. time. (See what I did there?)

A current network diagram plays a vital role in your overall PCI DSS Compliance program. Not only is it REQUIRED but it’s also used in a number of requirements to validate that you’ve established the correct configurations for your network security controls. 

And by the way, having a network diagram is critical when it’s time to do your end-to-end scope assessments.