Guide
Drawing a PCI data flow diagram
A PCI data flow diagram shows where card data enters your environment, where it travels and where it leaves. It is one of the first documents a QSA asks for, because scope depends on it.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What a PCI data flow diagram shows
It follows card data through each channel. For example, a web checkout, a phone order or a terminal. Then it marks every system, provider and person that touches the data.
So it differs from a network diagram. The network diagram shows connections, while the data flow diagram shows the journey of the data.
What to include in a PCI data flow diagram
Keep the diagram readable. Use one page per channel if needed.
| Element | Example |
|---|---|
| Entry points | Payment page, phone line, terminal |
| Systems | Applications, databases, gateways |
| Providers | Payment processor, hosting provider |
| Storage | Where data rests, if anywhere |
| Exit points | Processor, acquirer, deletion |
PCI data flow diagram check
Tick what your diagram already shows.
Your result appears here as you tick, so you can see what is still open.
Who draws the PCI data flow diagram
Engineers and payment owners usually draw it together. Then compliance checks it against scope. Also ask someone outside the team to read it, because unclear diagrams cause questions.
In addition, add a date and an owner.
How the diagram supports scope
Every system on the data path is in scope. So the diagram is the starting point for the inventory and the scope decision. Then segmentation and outsourcing decisions follow from it.
As a result, a good diagram often reveals easy scope reductions.
Keeping the PCI data flow diagram current
Update it after any change to payment channels or providers. Also review it at least once a year. Because the QSA compares it with reality, an outdated diagram becomes a finding.
Then keep old versions for reference.
Where Ashcroft helps
We map the flows with your teams and produce diagrams the QSA can follow. Policy and documentation work runs $10,000 to $30,000. We are not a QSA. The standard is in the PCI SSC document library.
PCI data flow diagram questions
Is a PCI data flow diagram required?
The standard expects current diagrams of card data flows. QSAs ask for them early.
How detailed should a PCI data flow diagram be?
Detailed enough to show every system and provider on the data path.
Who owns the PCI data flow diagram?
Usually the payment or engineering owner, with compliance reviewing.
Is it the same as a network diagram?
No. One shows connections, the other the data's journey.
Related guides
Draw your PCI data flow diagram
Tell us your payment channels. We reply with a written estimate, usually inside one business day.
Get my written estimate