Card Data Flow Worksheet
List the systems in your card flow and tick what each one handles. The worksheet sorts them into the groups the PCI DSS v4.0.1 scope section describes, and lists every log, session recording or analytics capture that, by your answers, records or logs a system that sees the full card number. It is a worksheet over what you declare. It does not decide scope, and it says nothing about whether any requirement is met. Scope decisions stay with your organisation and its assessor. To work out which self-assessment type applies, use the PCI DSS scope wizard; this page takes system nodes rather than its answers.
One row per system. "Raw number" means the full card number is visible to that system. "Token only" means it sees a substitute value. "Captures from" lists the ids of systems whose screens or traffic this one records, comma separated.
| id | kind | raw number | token only | stores | logs | records sessions | unrestricted link to a raw-number system | could affect its security | captures from |
|---|
Only your answers are used, and segmentation is left for you and your assessor to judge: the standard allows a system to be treated as outside scope only if it is properly segmented (isolated) so that it could not affect the security of card data even if compromised. A system left unplaced here is one your answers do not link to card data.
Source: PCI DSS v4.0.1, Section 4 "Scope of PCI DSS Requirements", and Requirement 3.5.1, as pinned in the node's cited clause digests.