Maintaining PCI DSS Compliance and a Secure Network: Are Your Network Diagrams Up-to-Date?

Network diagram checklist for PCI DSS Compliance

Maintaining PCI DSS Compliance is a multi-team effort. And it starts with knowing what's in scope for assessment. Your network and cardholder data flow diagrams are the heart and soul of your continuous PCI DSS Compliance program.

Peggy Nolan, PCI-P, CISA, Founder, Payment Card Assessments

Wait. What? We need a network diagram?

If you thought documenting your in scope PCI DSS processes were tough, getting alignment on the network diagram is like pulling teeth.

Why? I’m glad you asked.

The more complex your network environment is, the more people you’ll have involved with the creation, approval, and maintenance of your network diagram.

Likewise, the more cardholder data flows you have, the more data flow diagrams you’ll need.

Toss in the requirement for ownership, accountability, and responsibility of network and cardholder dataflow diagrams and you’ll have people pointing fingers at anyone else but themselves.

Let’s begin at the beginning and start with the PCI DSS requirement and testing procedures for maintaining a current and accurate network diagram.

Maintaining PCI DSS Compliance: Network Diagram Requirements

PCI DSS Requirement 1.2.3

An accurate network diagram(s) is maintained that shows all connections between the CDE and other networks, including any wireless networks.

Testing Procedure:

1.2.3.a Examine diagram(s) and network configurations to verify that an accurate network diagram(s) exists in accordance with all elements specified in this requirement.

1.2.3.b Examine documentation and interview responsible personnel to verify that the network diagram(s) is accurate and updated when there are changes to the environment.

The Purpose of Requirement 1.2.3:

Maintaining an accurate and up-to-date network diagram(s) prevents network connections and devices from being overlooked and unknowingly left unsecured and vulnerable to compromise.
A properly maintained network diagram(s) helps an organization verify its PCI DSS scope by identifying systems connecting to and from the CDE.

Trust us. Keeping up with your network diagrams goes a long way when it comes to maintaining your PCI DSS Compliance.

But wait. Is there more?

What Needs To Be Included In Your Network Diagrams

The PCI DSS outlines what you need to include in your diagrams.

Keep in mind, your diagram must show ALL connections between your CDE and all other networks, including wireless.

Best practice: Get everyone connected to the network diagram on the same page for keeping it current and accurate!

You must identify the following:

All connections to and from all system components in the CDE, including
- Systems providing security services
- Systems providing management services
- Systems providing maintenance services
The network diagram should also include the following:
- All locations, including retail locations, datacenters, corporate locations, cloud providers,etc.
- Clear labeling of all network segments
- All security controls providing segmentation, including unique identifiers for each control (for example, name of control, make, model, and version).
- All in-scope system components, including
  - NSCs
  - web app firewalls
  - anti-malware solutions
  - change management solutions
  - IDS/IPS
  - log aggregation systems
  - payment terminals
  - payment applications
  - HSMs, etc
Clear labeling of any out-of-scope areas on the diagram via a shaded box or other mechanism.
Date of last update, and names of people that made and approved the updates.
A legend or key to explain the diagram.
Diagrams should be updated by authorized personnel to ensure diagrams continue to provide an accurate description of the network.

Did you catch all those “all” statements?

Unfortunately, that word “all” gets overlooked all. the. time. (See what I did there?)

A current network diagram plays a vital role in your overall PCI DSS Compliance program. Not only is it REQUIRED but it’s also used in a number of requirements to validate that you’ve established the correct configurations for your network security controls.

And by the way, having a network diagram is critical when it’s time to do your end-to-end scope assessments.

Maintaining PCI DSS Compliance and a Secure Network: Are Your Network Diagrams Up-to-Date?

Wait. What? We need a network diagram?