What should the current diagram show per 1.1.3?

• A. A current diagram that shows all CHD flows across systems & networks.
• B. A diagram of external vendor locations.
• C. A firewall hardware inventory.
• D. A data center floor plan.

Answer: (D)

A current diagram of the cardholder data environment should be documented to understand exactly where CHD is stored, processed, and transmitted and how those components are physically and logically bounded. A current data center floor plan best serves this purpose because it provides the real layout of CHD assets, the locations of servers and network devices, and the security perimeters around them. This visual map helps ensure CHD remains within protected zones and that access controls, monitoring, and segmentation align with how the data actually flows and sits in the facility.

The other options don’t capture the full environment the requirement aims to map. A diagram of external vendor locations isn’t focused on how CHD is housed or protected within your own environment. A firewall hardware inventory is a hardware list, not a diagram of CHD boundaries or data flows. A data center floor plan, by showing where CHD-related assets lie and how they’re arranged, provides the most complete view for validating physical and logical security controls.