What should the data flow diagram show per 1.1.3?

• A. The data flow diagram shows all CHD flows across systems & networks.
• B. The data flow diagram shows only server names.
• C. The data flow diagram shows only password policies.
• D. The data flow diagram shows only network addresses.

Answer: (B)

The main idea being tested is how to represent cardholder data movements in a data flow diagram for PCI DSS compliance. The diagram should identify the systems and components involved in CHD flows using clear, stable references so stakeholders can understand where data travels and where CHD resides.

Why the best answer is showing only server names: using server names gives a concise, non-sensitive way to map the environment. It lets you trace CHD paths between specific components (which servers handle data, interface points, and data stores) without exposing additional sensitive details. Server names act as practical, stable identifiers that support scoping, governance, and conversation about security boundaries.

The other options drift from that practical purpose. Including password policies or network addresses reveals sensitive details and isn’t the point of mapping data flows. Describing all CHD flows across every system and network would be more detailed than necessary for a diagram focused on identifying components and connections by name, and could expose too much information in certain contexts.