By Yair Knijn · March 17, 2025

Your PCI network diagram is a work of fiction, and the QSA opened your IPAM to prove it

The security and audit lead walks into the assessment with a clean network diagram. Boxes for the CDE, a firewall line around it, arrows for the card data flow, a version stamp in the corner. It looks finished, so it gets treated as finished. That is the trap: the diagram was built as a drawing exercise, a picture of how the network was designed, instead of a reconciliation against what it actually runs today.

The QSA does not grade the picture. They use it as an independent reference and go looking for everything it left out. The drawing is your scope claim; live address space is the truth, and when the two disagree, the diagram loses.

What PCI DSS 4.0 1.2.3 and 12.5.1 actually demand of your inventory

Requirement 1.2.3 in PCI DSS v4.0.1 wants an accurate network diagram showing all connections between the cardholder data environment and other networks, and 1.2.4 wants a data-flow diagram for account data. The word doing the work in both is "accurate," and it has to be kept current after significant changes, not refreshed once a year for the audit. Requirement 12.5.1 backs that with a maintained inventory of in-scope system components, and 12.5.2 forces you to confirm scope at least annually, every six months for service providers.

These are not three documents. They are one assertion stated three ways: every in-scope system, where it sits, how card data moves through it. If the inventory and the diagram describe different networks, you have produced a contradiction and signed it.

How a QSA cross-checks the diagram against live address space

A competent assessor reconciles. They take the subnets named on the diagram, then ask what is actually assigned and live in that address space. They pull the firewall rule base for any source or destination CIDR that touches the CDE but never appears in the drawing. They check that segmentation testing and the pen test covered the boundary the diagram claims, not some smaller boundary you wish were true.

This is where a stale IPAM detonates. A spreadsheet that says 10.10.40.0/24 is "DMZ, decommissioned" while DHCP is still handing out leases on it is not a documentation nit. It is a live, in-scope segment your scope claim denies exists, and the QSA has the routing table to prove you wrong.

Ghost segments: in-scope CDE hosts the diagram forgot

Ghost segments are the ones nobody redrew. A jump host spun up for a migration and never torn down. A monitoring collector with a route into the CDE, living on a "management" VLAN the diagram treats as out of scope. A second /24 carved for a vendor integration, recorded in a change ticket and nowhere else. Each can reach card data, which makes it in-scope by definition, on address space your diagram never mentioned.

• Subnets the spreadsheet marks free that DHCP is actively leasing.
• Overlapping CIDRs where two teams were handed the same range and only one is drawn.
• Connected-but-undrawn segments that route into the CDE through a path the diagram omits.
• Decommissioned hosts still answering, still in DNS, still reachable from in-scope systems.

Every one is a finding. Collectively they are the segmentation argument falling apart, because the boundary you tested is not the boundary that exists.

Reconciliation as a control, not an annual scramble

Stop treating the diagram as an artifact and treat reconciliation as a control that runs continuously. Your inventory of in-scope systems and your live address space should be the same dataset queried two ways, not two documents that drift apart for fifty weeks and get hastily aligned before the assessor arrives. When a subnet changes ownership or a host appears in the CDE, that is when the record updates, because the record is what your 1.2.3 diagram is generated from.

Spot IPAM gives an Environment one reconciled source of truth for its address space: what each subnet is for, who owns it, what DHCP and DNS actually serve, which CIDRs overlap before they collide. When the diagram is rendered from live inventory instead of redrawn from memory, the QSA's cross-check stops being the moment your fiction unravels and becomes the moment your evidence holds. See how the reconciliation features keep the diagram and the network telling one story.