PCI DSS 4.0 1.2.4: 1.2.4 Accurate data-flow diagram for account data
The entity must keep one or more accurate data-flow diagrams that (a) show every path account data takes through networks and systems, and (b) are revised as required when the environment changes. Applicability: a data-flow diagram, or another technical or topological solution identifying how account data moves across systems and networks, can meet this requirement. Objective under the customized approach: a picture of how account data travels between system components and over network segments is kept and can be produced.
This control maps to 36 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 1.2.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.