Audit objective planner

Reconcile the proposed CDE boundary with inventories, data paths and connected systems; investigate omitted security-impacting components. Check the annual scope-confirmation record and reassessment after significant change; record service-provider applicability for additional review.

• Dated scope confirmation and change history
• System, data-location and third-party inventories with inclusion or exclusion rationale

The scope record covers the identified environment and applicable changes, with supported exclusions and a current confirmation record.

Compare diagram connections with scoped configuration and inventory exports; trace selected external, wireless and administrative paths. Check that relevant network changes are reflected in the diagram.

• Dated network diagram with CDE, wireless and external connections
• Device, subnet, cloud-route and network-security-control inventory

The diagram and observed inventory agree for the reviewed scope, including boundary connections and recorded changes.

Trace selected payment paths through applications, third parties and storage using metadata and redacted configuration. Compare those paths and relevant changes with the documented flows without collecting payment account data.

• Dated account-data flow diagram
• Application, integration and storage inventory with owner-confirmed data paths

The reviewed data paths and locations appear in the diagram, with owners and changes accounted for.

Reconcile enabled services and sampled rules with the approved inventory, including source, destination and owner. Investigate broad, temporary, unused or unowned permissions and confirm their disposition with the control owner.

• Service, protocol and port inventory with approval and business rationale
• Current rule exports and change approvals for sampled boundary controls

Reviewed enabled services and rules have traceable approval and a current business rationale; unexplained permissions remain exceptions.

Check that review records cover the scoped controls at least every six months. Inspect selected findings and follow-up against the reviewed configurations; a calendar entry alone is insufficient.

• Dated configuration-review records spanning the assessment period
• Reviewed rule-set versions, reviewer identity, findings and follow-up evidence

The period has traceable configuration reviews at the required cadence, with findings and follow-up recorded.

Compare inbound permissions and default-deny behavior with the approved traffic inventory and observed routing. Inspect actual sampled observations for necessary and unauthorized paths. Any new test needs separate authorization; this workflow does not send traffic.

• Active inbound rule sets and routing context for selected CDE boundaries
• Timestamped allowed and denied traffic metadata or authorized test records linked to those rules

Sampled inbound permissions match justified paths, and configuration plus observations support blocking other traffic for the tested boundary.

Compare outbound permissions and default-deny behavior with the business-need inventory, including indirect egress paths. Review sampled permitted and prohibited destinations against configuration and observations; document untested paths explicitly.

• Active outbound rule sets, routes and approved destinations
• Timestamped egress allow and deny metadata or authorized test records linked to selected paths

Sampled outbound permissions match justified paths, with configuration and observations supporting restriction of other traffic within the tested scope.