Which PCI DSS item requires a current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks?

Which PCI DSS item requires a current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks?

• A. Current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks
• B. A formal process for approving and testing all network connections
• C. A documented incident response plan
• D. An approved change management process

Answer: (A)

Maintaining a current network diagram that shows all connections between the cardholder data environment (CDE) and other networks, including wireless ones, is all about visibility of data flows and boundary control. When you can clearly see every path into and out of the CDE, you can ensure that only approved connections exist, place and validate firewall and access controls correctly, and monitor for any unexpected traffic crossing the boundary. Wireless networks are a common weak point, so including them in the diagram helps prevent overlooked entry points and supports accurate scoping of the PCI DSS controls. This diagram serves as a concrete artifact that supports secure network design and ongoing compliance. It makes it possible to assess risk, verify that segmentation is effective, and guide changes to network configurations with a clear map of where data travels. The other options describe important processes (approval and testing of connections, incident response planning, and change management) but do not fulfill the explicit requirement to produce and maintain a current network diagram identifying every connection to and from the CDE, including wireless networks.

Maintaining a current network diagram that shows all connections between the cardholder data environment (CDE) and other networks, including wireless ones, is all about visibility of data flows and boundary control. When you can clearly see every path into and out of the CDE, you can ensure that only approved connections exist, place and validate firewall and access controls correctly, and monitor for any unexpected traffic crossing the boundary. Wireless networks are a common weak point, so including them in the diagram helps prevent overlooked entry points and supports accurate scoping of the PCI DSS controls.

This diagram serves as a concrete artifact that supports secure network design and ongoing compliance. It makes it possible to assess risk, verify that segmentation is effective, and guide changes to network configurations with a clear map of where data travels. The other options describe important processes (approval and testing of connections, incident response planning, and change management) but do not fulfill the explicit requirement to produce and maintain a current network diagram identifying every connection to and from the CDE, including wireless networks.