RSI Security

Rethinking Your Cybersecurity

Category: Compliance Standards

Staying informed about all of the cyber security compliance standards is essential to keeping your company safe from hackers. Read on to learn about the various steps you can take to stay up to date with your industry’s compliance standards.

  • Do You Need a PCI DSS Network Diagram?

    Do You Need a PCI DSS Network Diagram?

    The Payment Card Industry’s (PCI) Data Security Standards (DSS) regulate the protection of cardholder data. All organizations that collect, store, transmit, or process data—termed “merchants”—must comply with DSS Requirements. And having a PCI DSS network diagram that visually represents cardholder data environments (CDE) is needed as part of your compliance efforts.

     

    PCI DSS Network Diagrams

    Network diagrams are explicitly specified within the PCI DSS subrequirements and certain annual compliance reports:

    • PCI DSS Requirement 1.1.2
    • PCI DSS Requirement 1.1.3
    • Report on Compliance (ROC)
    • Some Self-Assessment Questionnaire (SAQ) versions

    The PCI DSS applies to all merchants. Therefore, all organizations subject to PCI DSS regulations must create and maintain network diagrams. However, not every merchant must submit them. Including a PCI DSS network diagram as part of your documentation depends on your yearly reporting requirements.

    As a PCI compliance expert, RSI Security can assist your network diagram creation and updates, along with all other DSS adherence and reporting efforts.

     

    What is a Network Diagram?

    A network diagram is simply the visual representation of your organization’s computer network and may adopt a high-level or detailed view. A PCI network diagram must include all cardholder data environments, connected networks, and other connected IT resources in its scope.

     

    Request a Free Consultation

     

    Network Diagrams as Required by the PCI DSS—1.1.2 and 1.1.3

    The PCI DSS specifies network diagrams as obligatory in Requirements 1.1.2 and 1.1.3, mandating two different diagrams:

    • 1.1.2 – “Current network diagram that identifies all connections between the cardholder data environment and other networks, including any wireless networks.”
    • 1.1.3 – “Current diagram that shows all cardholder data flows across systems and networks.”

    planning

    Requirements 1.1.2 and 1.1.3 Testing Procedures

    Beyond specifying the DSS Requirements, the PCI Security Standards Council (SSC) provides testing procedures for merchants to check and verify their compliance efforts. Requirements 1.1.2 and 1.1.3’s testing procedures require verifying that all network and data-flow diagrams remain up-to-date and comprehensive. These efforts explicitly include interviewing relevant personnel for confirmation.

    Merchants should perform these testing procedures (or partner with a PCI DSS expert) periodically and following any network or CDE changes to maintain compliance.

     

    Creating a PCI Network Segmentation Diagram

    Organizations can segment—or separate via additional controls—their networks and connected CDEs to reduce PCI DSS scope and simplify their compliance efforts. To initiate and maintain this effort, a PCI network segmentation diagram is invaluable.

    Proper segmentation is achieved through purpose-built or implemented control processes and technologies (e.g., firewalls). It prevents communication and connection between the CDE and an organization’s other IT environments, systems, and resources.

    When creating network diagrams, segmentation technologies should be included as CDE boundaries and demonstrate that no traffic is permitted.

     

    Network Diagrams for Annual PCI DSS Reporting

    All PCI DSS-subject merchants must submit annual reporting documentation to verify their ongoing compliance. Some reports must contain network diagrams within the submitted documentation, the inclusion of which depends on an organization’s annual transaction volume and cardholder data activity.

     

    Report on Compliance (ROC) Network Diagrams

    The PCI DSS-subject companies that handle the most transactions annually (merchants processing over six million transactions across all channels, per SSC member Visa) must submit a Report on Compliance. ROCs are compiled following a thorough PCI DSS audit that must be conducted by an SSC-approved Qualified Security Assessor (QSA), such as RSI Security.

     

    PCI DSS Network Diagram Example for ROCs

    ROCs require organizations to provide two network diagrams: high-level and detailed. According to the PCI-provided ROC Template, PCI DSS network diagram example for each type must include:

    • High-level network diagrams – Overall CDE architecture and network topography (summarizing all locations, relevant systems, and their boundaries), including:
      • Inbound and outbound network connections and the demarcation points between the CDE(s) and other networks and zones
      • CDE critical components, including relevant POS devices, systems, databases, and web servers
      • Other necessary payment components
    • Detailed network diagrams – Communication and connection points between in-scope networks, environments, and facilities, including:
      • All CDE boundaries
      • Any network segmentation points that reduce PCI DSS compliance scope
      • Trusted and untrusted network boundaries
      • Connected networks (wireless and wired)
      • All other applicable connection points

    Security

    Self-Assessment Questionnaires (SAQs) Requiring Network Diagrams

    All organizations that handle fewer than six million annual transactions must complete and submit yearly SAQs. The PCI SSC provides nine different SAQ versions, each specific to business activity and cardholder data interactions.

    Four SAQ versions specifically ask whether the given organization maintains a current network diagram:

    • Version A-EP – For e-commerce merchants that have outsourced all payment processing to a PCI DSS-validated third party so that no cardholder data is electronically stored, processed, transmitted via their systems or on their premises.
    • Version B – For merchants that only use imprint machines or standalone, dial-out terminals (with no electronic cardholder data storage).
    • Version D (for merchants) – For merchants that do not meet the criteria for other SAQ versions
    • Version D (for service providers) – For any service provider that a payment card brand has defined as subject to the PCI DSS and annual SAQ submission

     

    Creating and Maintaining PCI DSS Network Diagrams

    Up-to-date and comprehensive PCI DSS network diagrams are required for compliance, regardless of whether your organization’s annual reports must include them within the submitted documentation. Though already mandatory, network diagrams provide a significantly helpful reference for understanding your organization’s PCI DSS scope (and reducing it via segmentation).

    RSI Security leverages our extensive experience with PCI DSS compliance as an SSC-approved Qualified Security Assessor to advise and assist organizations. 

    Contact RSI Security today to begin creating or updating your PCI network diagram.

     

    Speak with a PCI compliance expert today – Schedule a free consultation

  • Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards

    Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards

    Service organizations that outsource certain services must protect stakeholder information from cybersecurity risks. One of the best methods to demonstrate your ability to do so is adhering to AICPA standards and guidance (commonly assessed via SOC audits). Organizations may wonder which of the standards and assessments best suits their needs: SSAE 16 SOC 1 vs. SOC 2 or other standards? Read on to learn more about the various AICPA attestations. (more…)

  • How to Optimize Data Encryption in Healthcare

    How to Optimize Data Encryption in Healthcare

    Encrypting personal and personally identifiable information (PII) is critical for organizations in industries prone to cybersecurity threats, such as healthcare. Data encryption in healthcare is one essential part of compliance with regulatory frameworks such as HIPAA and HITRUST CSF, and it can be optimized by following some cutting-edge best practices. Read on to learn more. (more…)

  • Why Do You Need SOC 2? A Guide for SaaS Providers

    Why Do You Need SOC 2? A Guide for SaaS Providers

    Why do you need SOC 2 for providing SaaS services? SOC reports and audits can help service organizations assure clients and customers of robust, secure internal controls for managing outsourced services and associated data. Read on to learn how SOC 2 compliance can help you build trust assurance for your clients. (more…)

  • How to Meet the CCPA Requirements for Enterprise Privacy Risk Assessment?

    How to Meet the CCPA Requirements for Enterprise Privacy Risk Assessment?

    The California Consumer Protection Act (CCPA) was created to respect and protect consumer data. It ensures certain rights—like the right to opt-out of data collection programs—and it introduces numerous disclosure, privacy policy, and enterprise privacy risk assessment requirements that organizations must follow. (more…)

  • What Are the HITRUST Encryption Requirements?

    What Are the HITRUST Encryption Requirements?

    Founded in 2007, HITRUST initially provided a comprehensive framework for safeguarding protected health information (PHI) and electronic health records (EHR) in the medical industry. Since then, the HITRUST CSF has expanded to include the most widely applicable compliance requirements across numerous industries and organizational activities. Although there aren’t any specific HITRUST encryption requirements, some of the standards it includes—specifically, HIPAA—do require encryption. (more…)

  • Does Your Organization Need Privacy by Design Certification?

    Does Your Organization Need Privacy by Design Certification?

    Privacy by Design certification helps ensure acceptable privacy standards per the European Union’s (EU) General Data Protection Regulation (GDPR). Although certification is not explicitly a GDPR requirement, the concept of Privacy by Design (PbD) is. What certification achieves is one of the few up-front and tangible methods to demonstrate that protecting data subjects’ personal information is an essential consideration factored throughout systems design, service delivery, and ongoing management. Despite the GDPR’s recent publication, designing IT systems around data privacy is nothing new nor exclusive to the EU’s regulation.  (more…)

  • How to Conduct a SOC 2 Gap Assessment

    How to Conduct a SOC 2 Gap Assessment

    System and Organizations Controls (SOC) reporting comes in multiple varieties, with each kind applying to different industries or intended for different audiences. SOC 2 is primarily aimed at Software-as-a-Service (SaaS) providers and similar service organizations. Although SOC 2 compliance provides a comprehensive framework for security, data integrity, user privacy, and more, there are some issues that can only be identified with a SOC 2 gap assessment.   (more…)

  • What is the SOC 2 Certification Validity Period?

    What is the SOC 2 Certification Validity Period?

    Overseen by the American Institute of Certified Public Accountants (AICPA), SOC 2 evaluates the implementation of effective standards and controls for organizations outside the financial sector, including software-as-a-service (SaaS) providers. Since the SOC 2 certification validity period only lasts for a limited amount of time, those pursuing certification on a long-term basis will need to dedicate themselves to learning and maintaining these rules.  (more…)

  • What Can You Do After a HITRUST Assessment Failed? Top Remediation Strategies

    What Can You Do After a HITRUST Assessment Failed? Top Remediation Strategies

    With more than 20 individual processes, requirements, and standards under its umbrella, the HITRUST Alliance provides a centralized set of guidelines for professionals in the healthcare industry and beyond. Unfortunately, because it incorporates so many frameworks, many entities who take a HITRUST assessment failed their initial or secondary attempts. Thankfully, there are plenty of remediation strategies available—including retaking the test—for those who have yet to pass. (more…)