CDE General Inventory Template

Many of us have already begun to analyze and even work on the adaptations and new requirements for the transition process of the version of PCI DSS 3.2.1 to the version 4.0.

In order to support the entities with the adaptations, I developed a template (template) a general inventory of the CDE that allows to have a basis on which they can start working and modify according to the specific needs of each organization. This document considers some clarifications regarding the previous version of the standard and includes new listings and/or inventories that are required by version 4.0.

If something I have learned in these years as QSA is that although the standard is the same for everyone, each entity is a very different world and reality, being that the same requirement totally changes its applicability between one environment and another. That's why I try to cover as much spectrum as possible with a very general document, with fields and minimal information required by the standard.

Last but not least, I developed the document by including the minimum information that I personally like to receive to start a PCI DSS Level 1 assessment, always noting that the entities that manage a “centralised” inventory are the ones that generally (not always, but most of the time) have a level of maturity in the PCI DSS recertification process.

NOTE: In no way should this or any other format be considered as “mandatory” to validate compliance with PCI DSS. The standard, in both versions, indicates that there must be a inventory with minimum required information. However, it does not have to be a specific format and it is up to the entity to choose how it develops its documentation. to meet the specific requirements.Feel free to modify and adapt the inventory to the taste and specific needs of each organization.