<mxfile host="app.diagrams.net" agent="Claude" version="24.0.0">
  <diagram id="net-topology" name="1. Топология CDE (significant change)">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1700" pageHeight="1169" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />

        <mxCell id="title" value="PCI DSS 4.0.1 — Ресертификация (Significant Change: VMware → Virtuozzo). Сетевая топология CDE оператора IaaS" style="text;html=1;fontSize=18;fontStyle=1;align=left;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1200" height="30" as="geometry" />
        </mxCell>
        <mxCell id="chgnote" value="Δ Изменение платформы виртуализации: было VMware vSphere — стало Virtuozzo Hybrid Server. Требуется переоценка in-scope компонентов, тест сегментации и обновление документации." style="text;html=1;fontSize=12;align=left;fillColor=#fff2cc;strokeColor=#d6b656;" vertex="1" parent="1">
          <mxGeometry x="40" y="52" width="1200" height="28" as="geometry" />
        </mxCell>

        <!-- Internet cloud -->
        <mxCell id="inet" value="Internet&#10;ISP-A / ISP-B (BGP)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=cloud;fillColor=#FFFFFF;strokeColor=#005073;" vertex="1" parent="1">
          <mxGeometry x="760" y="100" width="120" height="80" as="geometry" />
        </mxCell>

        <!-- Edge routers Cisco -->
        <mxCell id="edge1" value="Edge RTR-1" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=router;fillColor=#FFFFFF;strokeColor=#005073;" vertex="1" parent="1">
          <mxGeometry x="660" y="220" width="100" height="70" as="geometry" />
        </mxCell>
        <mxCell id="edge2" value="Edge RTR-2" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=router;fillColor=#FFFFFF;strokeColor=#005073;" vertex="1" parent="1">
          <mxGeometry x="880" y="220" width="100" height="70" as="geometry" />
        </mxCell>

        <!-- FortiGate HA cluster zone -->
        <mxCell id="fgtzone" value="FortiGate 1800F — HA-кластер (FGCP Active-Passive). Сегментация CDE через VDOM. Req. 1.2/1.3/1.4" style="rounded=1;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#DA291C;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#DA291C;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="560" y="330" width="540" height="170" as="geometry" />
        </mxCell>
        <mxCell id="fgt1" value="FGT-1 1800F&#10;(Primary)" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;fontColor=#000000;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="620" y="370" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="fgt2" value="FGT-2 1800F&#10;(Secondary)" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;fontColor=#000000;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="950" y="370" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="haln" value="FGCP HA heartbeat" style="endArrow=none;dashed=1;html=1;strokeColor=#DA291C;strokeWidth=2;" edge="1" parent="1" source="fgt1" target="fgt2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="vdomlbl" value="VDOM: EDGE | DMZ | CDE | MGMT | TENANT" style="text;html=1;fontSize=12;align=center;fontStyle=2;" vertex="1" parent="1">
          <mxGeometry x="700" y="465" width="260" height="20" as="geometry" />
        </mxCell>

        <!-- Core switches Cisco Nexus -->
        <mxCell id="corezone" value="Core / Aggregation (L3, M-LAG, 802.1Q VLAN)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#1BA0D7;verticalAlign=top;fontStyle=1;fontColor=#1BA0D7;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="600" y="540" width="460" height="130" as="geometry" />
        </mxCell>
        <mxCell id="sw1" value="Core-SW-1" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=l3_switch;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="660" y="575" width="100" height="70" as="geometry" />
        </mxCell>
        <mxCell id="sw2" value="Core-SW-2" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=l3_switch;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="900" y="575" width="100" height="70" as="geometry" />
        </mxCell>
        <mxCell id="mlag" value="M-LAG" style="endArrow=none;dashed=1;html=1;strokeColor=#1BA0D7;" edge="1" parent="1" source="sw1" target="sw2"><mxGeometry relative="1" as="geometry" /></mxCell>

        <!-- CDE zone -->
        <mxCell id="cdezone" value="IN-SCOPE — кластер Virtuozzo HS (4 узла): размещает МНОЖЕСТВЕННЫЕ тенанты-CDE (CDE-1…CDE-N), по одному VLAN+VDOM на тенант. Каждый — отдельный CDE со своим ROC." style="rounded=1;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#DA291C;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="80" y="710" width="820" height="380" as="geometry" />
        </mxCell>

        <mxCell id="acc" value="CDE Access-SW (VLAN)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=l2_switch;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="440" y="730" width="100" height="60" as="geometry" />
        </mxCell>

        <mxCell id="n1" value="Node-1&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="120" y="830" width="80" height="90" as="geometry" />
        </mxCell>
        <mxCell id="n2" value="Node-2&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="320" y="830" width="80" height="90" as="geometry" />
        </mxCell>
        <mxCell id="n3" value="Node-3&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="520" y="830" width="80" height="90" as="geometry" />
        </mxCell>
        <mxCell id="n4" value="Node-4&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="720" y="830" width="80" height="90" as="geometry" />
        </mxCell>

        <mxCell id="vzstore" value="Virtuozzo Storage (реплика 3) — шифрование at-rest (Req. 3.5)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;align=center;" vertex="1" parent="1">
          <mxGeometry x="300" y="960" width="320" height="70" as="geometry" />
        </mxCell>
        <mxCell id="cdewl" value="Нагрузки CDE: payment-app, API, БД с PAN (зашифр.), HSM. In-CDE: FIM/IDS (11.5), AV (5), логи (10), vuln-scan (11.3)." style="text;html=1;align=left;fontSize=11;fillColor=#FFFFFF;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="120" y="1040" width="680" height="40" as="geometry" />
        </mxCell>

        <!-- MGMT zone -->
        <mxCell id="mgmtzone" value="MGMT / Security services (out-of-band VDOM)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#1BA0D7;verticalAlign=top;fontStyle=1;fontColor=#1BA0D7;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="940" y="710" width="700" height="380" as="geometry" />
        </mxCell>
        <mxCell id="bastion" value="Bastion / PAM + MFA&#10;(8.4/8.5)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="980" y="760" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="siem" value="SIEM / Logs&#10;(10.2-10.7)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1130" y="760" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="vzmgmt" value="Virtuozzo Mgmt&#10;Panel" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1280" y="760" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="patch" value="Patch / Repo&#10;(6.3)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1430" y="760" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="vscan" value="ASV / Vuln scan&#10;(11.3)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="980" y="900" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="aaa" value="NTP/DNS/AAA&#10;(RADIUS/AD)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1130" y="900" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="bkp" value="Backup (зашифр.)&#10;(3.5/9.4)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1280" y="900" width="80" height="80" as="geometry" />
        </mxCell>
        <mxCell id="fim" value="FIM / IDS console&#10;(11.5)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1430" y="900" width="80" height="80" as="geometry" />
        </mxCell>

        <!-- Links -->
        <mxCell id="l1" style="endArrow=classic;html=1;" edge="1" parent="1" source="inet" target="edge1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l2" style="endArrow=classic;html=1;" edge="1" parent="1" source="inet" target="edge2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l3" style="endArrow=classic;html=1;" edge="1" parent="1" source="edge1" target="fgt1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l4" style="endArrow=classic;html=1;" edge="1" parent="1" source="edge2" target="fgt2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l5" style="endArrow=classic;html=1;" edge="1" parent="1" source="fgt1" target="sw1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l6" style="endArrow=classic;html=1;" edge="1" parent="1" source="fgt2" target="sw2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l7" style="endArrow=classic;html=1;" edge="1" parent="1" source="sw1" target="acc"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l8" style="endArrow=classic;html=1;" edge="1" parent="1" source="sw2" target="acc"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l9" style="endArrow=classic;html=1;" edge="1" parent="1" source="acc" target="n1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l10" style="endArrow=classic;html=1;" edge="1" parent="1" source="acc" target="n2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l11" style="endArrow=classic;html=1;" edge="1" parent="1" source="acc" target="n3"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l12" style="endArrow=classic;html=1;" edge="1" parent="1" source="acc" target="n4"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="l13" style="endArrow=classic;html=1;dashed=1;" edge="1" parent="1" source="sw2" target="mgmtzone"><mxGeometry relative="1" as="geometry" /></mxCell>
      </root>
    </mxGraphModel>
  </diagram>

  <diagram id="vdom" name="2. Сегментация VDOM (FortiGate)">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1700" pageHeight="1100" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t2" value="PCI DSS 4.0.1 — Сегментация через VDOM на FortiGate 1800F (HA). Req. 1.2/1.3/1.4 + тест сегментации 11.4.5" style="text;html=1;fontSize=18;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1300" height="30" as="geometry" />
        </mxCell>

        <!-- Central FortiGate cluster -->
        <mxCell id="fgtA" value="FGT-1 1800F" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="720" y="470" width="100" height="100" as="geometry" />
        </mxCell>
        <mxCell id="fgtB" value="FGT-2 1800F" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="860" y="470" width="100" height="100" as="geometry" />
        </mxCell>
        <mxCell id="hatxt" value="FGCP HA (Active-Passive)" style="text;html=1;align=center;fontSize=11;fontStyle=2;" vertex="1" parent="1">
          <mxGeometry x="710" y="575" width="260" height="20" as="geometry" />
        </mxCell>
        <mxCell id="hae" value="" style="endArrow=none;dashed=1;html=1;strokeColor=#DA291C;strokeWidth=2;" edge="1" parent="1" source="fgtA" target="fgtB"><mxGeometry relative="1" as="geometry" /></mxCell>

        <!-- VDOM EDGE -->
        <mxCell id="vEDGE" value="VDOM: EDGE&#10;Internet uplink, NGFW (IPS/AV/App-Ctrl), anti-DDoS, inbound VIP→DMZ. Логи NSC→SIEM (1.2.6)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E8F5E9;strokeColor=#82b366;verticalAlign=top;fontStyle=1;align=left;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="120" y="120" width="300" height="120" as="geometry" />
        </mxCell>

        <!-- VDOM DMZ -->
        <mxCell id="vDMZ" value="VDOM: DMZ&#10;Публичные web/API, reverse-proxy/WAF, payment page (6.4.3/11.6.1). PAN не хранит." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;verticalAlign=top;fontStyle=1;align=left;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="1260" y="120" width="300" height="120" as="geometry" />
        </mxCell>

        <!-- VDOM CDE -->
        <mxCell id="vCDE" value="VDOM: CDE (in-scope)&#10;payment-app, БД PAN, HSM. Deny-by-default, stateful per-session, IPS (11.5.1), полное логирование (10)." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=2;verticalAlign=top;fontStyle=1;align=left;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="120" y="820" width="300" height="130" as="geometry" />
        </mxCell>

        <!-- VDOM MGMT -->
        <mxCell id="vMGMT" value="VDOM: MGMT (out-of-band)&#10;Доступ админов через Bastion+MFA, Virtuozzo mgmt, IPMI/BMC, SIEM, NTP/DNS/AAA. Изоляция от tenant и Internet (2.2.7/8.4)." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;verticalAlign=top;fontStyle=1;align=left;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="1260" y="820" width="300" height="130" as="geometry" />
        </mxCell>

        <!-- VDOM TENANT -->
        <mxCell id="vTEN" value="VDOM: TENANT (out-of-scope)&#10;Клиентские неплатёжные нагрузки. Полная изоляция от CDE — тест сегментации 11.4.5 (для SP раз в 6 мес.)." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#F5F5F5;strokeColor=#666666;verticalAlign=top;fontStyle=1;align=left;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="700" y="850" width="320" height="120" as="geometry" />
        </mxCell>

        <!-- connections from VDOM to FGT with policy labels -->
        <mxCell id="p1" value="EDGE→DMZ: 443/VIP" style="endArrow=classic;html=1;strokeColor=#82b366;fontStyle=1;" edge="1" parent="1" source="vEDGE" target="fgtA"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="p2" value="DMZ→CDE: app/API только" style="endArrow=classic;html=1;strokeColor=#d6b656;fontStyle=1;" edge="1" parent="1" source="vDMZ" target="fgtB"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="p3" value="established only" style="endArrow=classic;html=1;strokeColor=#DA291C;fontStyle=1;" edge="1" parent="1" source="vCDE" target="fgtA"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="p4" value="через Bastion (аудит)" style="endArrow=classic;html=1;strokeColor=#1BA0D7;fontStyle=1;" edge="1" parent="1" source="vMGMT" target="fgtB"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="p5" value="TENANT⇄CDE: DENY" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#DA291C;dashed=1;fontStyle=1;fontColor=#DA291C;" edge="1" parent="1" source="vTEN" target="fgtA"><mxGeometry relative="1" as="geometry" /></mxCell>

        <!-- Policy matrix box -->
        <mxCell id="pm" value="Матрица inter-VDOM (deny by default)&#10;&#10;EDGE → DMZ      443/tcp (VIP)&#10;DMZ  → CDE       только app/API порты&#10;CDE  → DMZ       established only&#10;MGMT → all       через Bastion + аудит&#10;TENANT ⇄ CDE    ЗАПРЕЩЕНО&#10;any  → Internet  whitelisted egress&#10;остальное        DENY + log" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#EDE7F6;strokeColor=#9673a6;align=left;fontFamily=Courier New;fontSize=12;verticalAlign=top;spacingLeft=10;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="620" y="120" width="440" height="220" as="geometry" />
        </mxCell>

        <mxCell id="note2" value="Каждый VDOM — независимый виртуальный firewall (своя таблица маршрутизации и политики). Трафик между VDOM проходит только через явные inter-VDOM правила. CDE минимизирован. Эффективность изоляции подтверждается пентестом сегментации (11.4.5); при significant change тест выполняется заново." style="text;html=1;align=left;fontSize=12;fillColor=#FFFFFF;strokeColor=#999999;" vertex="1" parent="1">
          <mxGeometry x="120" y="640" width="1440" height="60" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>

  <diagram id="dataflow" name="3. Поток данных карт">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1700" pageHeight="900" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t3" value="PCI DSS 4.0.1 — Поток данных держателей карт (CHD/SAD). Req. 3 (хранение) / 4 (передача)" style="text;html=1;fontSize=18;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1300" height="30" as="geometry" />
        </mxCell>

        <mxCell id="user" value="Держатель карты" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=pc;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="60" y="160" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="fw" value="FortiGate 1800F&#10;(EDGE/DMZ VDOM)" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="280" y="155" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="waf" value="Payment page / WAF&#10;(DMZ)&#10;TLS 1.2+/1.3 (4.2.1)&#10;Контроль скриптов (6.4.3)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#d6b656;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="500" y="155" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="app" value="Payment App / API&#10;(CDE)&#10;Токенизация PAN" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="730" y="155" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="db" value="БД с PAN (CDE)&#10;at-rest шифр. (3.5.1)&#10;маскирование (3.4.1)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="960" y="155" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="hsm" value="HSM / Key Mgmt (CDE)&#10;ключи (3.6/3.7)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#9673a6;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="960" y="320" width="90" height="90" as="geometry" />
        </mxCell>
        <mxCell id="acq" value="Acquirer / Платёжная&#10;система (внешний)&#10;TLS (4.2.1)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=cloud;fillColor=#FFFFFF;strokeColor=#82b366;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1200" y="155" width="110" height="90" as="geometry" />
        </mxCell>

        <mxCell id="f1" value="HTTPS/TLS" style="endArrow=classic;html=1;" edge="1" parent="1" source="user" target="fw"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="f2" value="" style="endArrow=classic;html=1;" edge="1" parent="1" source="fw" target="waf"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="f3" value="mTLS внутр." style="endArrow=classic;html=1;" edge="1" parent="1" source="waf" target="app"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="f4" value="зашифр. запись" style="endArrow=classic;html=1;" edge="1" parent="1" source="app" target="db"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="f5" value="ключи" style="endArrow=classic;html=1;dashed=1;" edge="1" parent="1" source="hsm" target="db"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="f6" value="авторизация TLS" style="endArrow=classic;html=1;" edge="1" parent="1" source="app" target="acq"><mxGeometry relative="1" as="geometry" /></mxCell>

        <mxCell id="leg" value="Зоны: голубой — вне CDE (клиент); жёлтый — DMZ (CHD транзитом, без хранения); красный — CDE (хранение/обработка PAN); зелёный — внешние доверенные стороны.&#10;SAD (CVV/track/PIN) НЕ хранится после авторизации (3.3.1). PAN — только зашифрованный/маскированный. Передача CHD по открытым сетям — TLS 1.2+ (4.2.1)." style="text;html=1;align=left;fontSize=13;fillColor=#FFFFFF;strokeColor=#999999;" vertex="1" parent="1">
          <mxGeometry x="60" y="470" width="1250" height="80" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>

  <diagram id="change-impact" name="4. Change-Impact (VMware→Virtuozzo)">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1700" pageHeight="1200" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t4" value="PCI DSS 4.0.1 — Change-Impact карта. Significant change: VMware vSphere → Virtuozzo Hybrid Server. Full reassessment." style="text;html=1;fontSize=18;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1400" height="30" as="geometry" />
        </mxCell>

        <!-- BEFORE column -->
        <mxCell id="beforeHdr" value="БЫЛО (VMware vSphere)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;fontStyle=1;fontColor=#0B6E99;" vertex="1" parent="1">
          <mxGeometry x="60" y="80" width="380" height="40" as="geometry" />
        </mxCell>
        <mxCell id="b1" value="ESXi hosts + vCenter" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="140" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b2" value="vSphere VMkernel / NSX сегментация" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="210" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b3" value="VMFS / vSAN datastore" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="280" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b4" value="vSphere RBAC / SSO" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="350" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b5" value="ESXi hardening (CIS VMware) / vSphere patch baseline" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="420" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b6" value="vCenter logs → SIEM" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="490" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="b7" value="Изоляция тенантов через NSX DFW / VLAN" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="60" y="560" width="380" height="50" as="geometry" />
        </mxCell>

        <!-- AFTER column -->
        <mxCell id="afterHdr" value="СТАЛО (Virtuozzo Hybrid Server)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;fontStyle=1;fontColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="80" width="380" height="40" as="geometry" />
        </mxCell>
        <mxCell id="a1" value="4× Virtuozzo HS узла (KVM/CT) + Mgmt Panel" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="140" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a2" value="Virtuozzo vNetwork + VLAN; сегментация на FortiGate VDOM" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="210" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a3" value="Virtuozzo Storage (реплика 3), шифрование at-rest" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="280" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a4" value="Virtuozzo RBAC + внешний AAA (RADIUS/AD), MFA" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="350" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a5" value="Virtuozzo HS hardening (новый стандарт) / patch-репо" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="420" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a6" value="Virtuozzo + гостевые логи → SIEM (новые источники)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="490" width="380" height="50" as="geometry" />
        </mxCell>
        <mxCell id="a7" value="Изоляция тенантов средствами Virtuozzo + VDOM" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="640" y="560" width="380" height="50" as="geometry" />
        </mxCell>

        <!-- REQ impact column -->
        <mxCell id="reqHdr" value="ПЕРЕОЦЕНИВАЕМЫЕ ТРЕБОВАНИЯ" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;fontStyle=1;fontColor=#8a6d00;" vertex="1" parent="1">
          <mxGeometry x="1220" y="80" width="420" height="40" as="geometry" />
        </mxCell>
        <mxCell id="r1" value="Req. 2.2 (hardening), 1.2 (NSC), 12.5.1 (asset inventory)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="140" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r2" value="Req. 1.3/1.4, 11.4.5/11.4.6 (тест сегментации заново), A1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="210" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r3" value="Req. 3.5 (at-rest), 9.4 (медиа), 3.6/3.7 (ключи)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="280" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r4" value="Req. 7 (RBAC), 8.2/8.3/8.4/8.5 (MFA, аутентификация)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="350" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r5" value="Req. 2.2, 6.3.3 (патчи ≤30 дн), 6.2 (baseline)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="420" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r6" value="Req. 10.2-10.7 (логи, новые источники), 10.6 (NTP)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="490" width="420" height="50" as="geometry" />
        </mxCell>
        <mxCell id="r7" value="Appendix A1 (multi-tenant isolation), 11.4.5" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1">
          <mxGeometry x="1220" y="560" width="420" height="50" as="geometry" />
        </mxCell>

        <!-- arrows before->after -->
        <mxCell id="ar1" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b1" target="a1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar2" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b2" target="a2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar3" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b3" target="a3"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar4" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b4" target="a4"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar5" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b5" target="a5"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar6" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b6" target="a6"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="ar7" style="endArrow=classic;html=1;strokeColor=#DA291C;" edge="1" parent="1" source="b7" target="a7"><mxGeometry relative="1" as="geometry" /></mxCell>
        <!-- arrows after->req -->
        <mxCell id="br1" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a1" target="r1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br2" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a2" target="r2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br3" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a3" target="r3"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br4" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a4" target="r4"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br5" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a5" target="r5"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br6" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a6" target="r6"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="br7" style="endArrow=classic;html=1;strokeColor=#d6b656;" edge="1" parent="1" source="a7" target="r7"><mxGeometry relative="1" as="geometry" /></mxCell>

        <!-- reassessment activities -->
        <mxCell id="actHdr" value="Обязательные активности при full reassessment" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#EDE7F6;strokeColor=#9673a6;fontStyle=1;fontColor=#5E35B1;" vertex="1" parent="1">
          <mxGeometry x="60" y="680" width="1580" height="40" as="geometry" />
        </mxCell>
        <mxCell id="act" value="1) Change-record с оценкой влияния на PCI-охват (6.5.1)   2) Обновить scope, asset inventory, dataflow и network diagrams (12.5.1/12.5.2)   3) Новые hardening-стандарты Virtuozzo (2.2)&#10;4) Внутренний + ASV vuln-скан после изменения (11.3.1.3)   5) Пентест сегментации заново (11.4.5/11.4.6)   6) Подключить новые источники логов в SIEM (10)   7) Пересмотр изоляции тенантов (A1)&#10;8) Обновить процедуры ключей/шифрования (3.5-3.7)   9) Обучение персонала по новой платформе (12.6)   10) ROC/AOC v4.0.1 c QSA — полная переоценка всех применимых требований." style="text;html=1;align=left;fontSize=12;fillColor=#FFFFFF;strokeColor=#9673a6;spacingLeft=8;spacingTop=6;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="60" y="730" width="1580" height="120" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>

  <diagram id="dataflow-detailed" name="5. Детальный поток данных карт">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="2400" pageHeight="1600" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />

        <mxCell id="t5" value="PCI DSS 4.0.1 — Детальный поток данных держателей карт (CHD/SAD). Модель: полный PAN хранят/обрабатывают клиенты-тенанты IaaS. Порты · протоколы · состояния данных." style="text;html=1;fontSize=17;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="16" width="2200" height="26" as="geometry" />
        </mxCell>
        <mxCell id="t5b" value="Ответственность оператора IaaS: инфраструктурный контур (периметр, сегментация VDOM, гипервизор, хранилище). Оператор НЕ обрабатывает PAN — данные проходят/хранятся внутри клиентских VM/CT (зона ответственности тенанта). Граница ответственности показана пунктиром." style="text;html=1;fontSize=12;align=left;fillColor=#FFF8E1;strokeColor=#d6b656;" vertex="1" parent="1">
          <mxGeometry x="40" y="46" width="2200" height="34" as="geometry" />
        </mxCell>

        <!-- ===== SWIMLANE ZONES (vertical bands) ===== -->
        <mxCell id="zUser" value="Internet / Untrusted" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F5F5F5;strokeColor=#999999;verticalAlign=top;fontStyle=1;fontColor=#666666;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="40" y="100" width="300" height="1260" as="geometry" />
        </mxCell>
        <mxCell id="zEdge" value="VDOM EDGE (FortiGate 1800F HA)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E8F5E9;strokeColor=#82b366;verticalAlign=top;fontStyle=1;fontColor=#4a7a3a;" vertex="1" parent="1">
          <mxGeometry x="360" y="100" width="300" height="1260" as="geometry" />
        </mxCell>
        <mxCell id="zDmz" value="VDOM DMZ (оператор)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;verticalAlign=top;fontStyle=1;fontColor=#8a6d00;" vertex="1" parent="1">
          <mxGeometry x="680" y="100" width="340" height="1260" as="geometry" />
        </mxCell>
        <mxCell id="zCde" value="VDOM CDE — клиентский сегмент (зона ответственности тенанта)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#DA291C;" vertex="1" parent="1">
          <mxGeometry x="1040" y="100" width="780" height="1260" as="geometry" />
        </mxCell>
        <mxCell id="zExt" value="Внешние стороны" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E8F5E9;strokeColor=#82b366;verticalAlign=top;fontStyle=1;fontColor=#4a7a3a;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="1840" y="100" width="300" height="1260" as="geometry" />
        </mxCell>
        <mxCell id="zMgmt" value="VDOM MGMT (out-of-band, оператор) — НЕ имеет доступа к CHD" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;verticalAlign=top;fontStyle=1;fontColor=#0B6E99;dashed=1;" vertex="1" parent="1">
          <mxGeometry x="40" y="1380" width="2100" height="160" as="geometry" />
        </mxCell>

        <!-- operator responsibility boundary (dashed big box around infra) -->
        <mxCell id="opBound" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=none;strokeColor=#1BA0D7;dashed=1;dashPattern=8 8;strokeWidth=2;" vertex="1" parent="1">
          <mxGeometry x="350" y="130" width="700" height="1240" as="geometry" />
        </mxCell>
        <mxCell id="opBoundLbl" value="Контур инфраструктуры оператора (EDGE+DMZ+гипервизор+хранилище)" style="text;html=1;fontSize=10;fontColor=#1BA0D7;align=left;rotation=90;" vertex="1" parent="1">
          <mxGeometry x="300" y="700" width="360" height="20" as="geometry" />
        </mxCell>

        <!-- ===== NODES ===== -->
        <!-- cardholder -->
        <mxCell id="ch" value="Держатель карты&#10;(браузер / POS / app)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=pc;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="120" y="180" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="chNote" value="Ввод: PAN+expiry+CVV (SAD)&#10;Состояние: открытый текст&#10;в памяти устройства" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="60" y="280" width="240" height="50" as="geometry" />
        </mxCell>

        <!-- FortiGate edge -->
        <mxCell id="fgt" value="FortiGate 1800F&#10;EDGE VDOM&#10;NGFW/IPS/anti-DDoS" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="450" y="180" width="100" height="100" as="geometry" />
        </mxCell>
        <mxCell id="fgtNote" value="VIP/DNAT → DMZ&#10;Терминация TLS НЕ здесь&#10;(passthrough к WAF)&#10;Состояние: TLS-туннель&#10;(зашифровано в канале)" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="390" y="300" width="240" height="70" as="geometry" />
        </mxCell>

        <!-- WAF/proxy DMZ -->
        <mxCell id="waf" value="WAF / Reverse-proxy&#10;(DMZ, оператор)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#d6b656;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="800" y="180" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="wafNote" value="TLS терминация/реэнкрипт&#10;Req. 4.2.1 (TLS 1.2+/1.3)&#10;Req. 6.4.3/11.6.1 (скрипты&#10;платёжной страницы)&#10;PAN НЕ хранится в DMZ" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="740" y="280" width="240" height="80" as="geometry" />
        </mxCell>

        <!-- Client payment app (in tenant CDE) -->
        <mxCell id="app" value="Payment App / API&#10;(VM/CT клиента)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1120" y="180" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="appNote" value="Обработка PAN (клиент)&#10;Состояние: открытый PAN&#10;в защищённой памяти VM&#10;Маскирование при выводе&#10;(Req. 3.4.1)" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="1100" y="280" width="230" height="80" as="geometry" />
        </mxCell>

        <!-- DB with PAN (tenant) -->
        <mxCell id="db" value="БД с PAN&#10;(VM/CT клиента)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1430" y="180" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="dbNote" value="Хранение PAN (клиент)&#10;Состояние: зашифрован&#10;at-rest (Req. 3.5.1)&#10;SAD НЕ хранится (3.3.1)" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="1400" y="280" width="220" height="70" as="geometry" />
        </mxCell>

        <!-- Token vault (tenant) -->
        <mxCell id="vault" value="Token Vault&#10;(VM/CT клиента)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#9673a6;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1660" y="180" width="90" height="80" as="geometry" />
        </mxCell>
        <mxCell id="vaultNote" value="PAN ↔ токен&#10;Состояние: PAN зашифрован,&#10;токен необратим вне vault" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="1630" y="280" width="200" height="60" as="geometry" />
        </mxCell>

        <!-- HSM/KMS (tenant) -->
        <mxCell id="hsm" value="HSM / KMS&#10;(клиент или сервис)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#9673a6;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1270" y="560" width="100" height="80" as="geometry" />
        </mxCell>
        <mxCell id="hsmNote" value="Ключи DEK/KEK (3.6/3.7)&#10;PKCS#11 / KMIP&#10;(порт 5696/tcp TLS)&#10;Шифр/дешифр PAN, токенизация" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="1240" y="650" width="240" height="60" as="geometry" />
        </mxCell>

        <!-- Acquirer -->
        <mxCell id="acq" value="Acquirer /&#10;Платёжная система" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=cloud;fillColor=#FFFFFF;strokeColor=#82b366;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1900" y="180" width="110" height="80" as="geometry" />
        </mxCell>
        <mxCell id="acqNote" value="Авторизация/клиринг&#10;TLS 1.2+ (Req. 4.2.1)&#10;mTLS, IP-allowlist&#10;Состояние: зашифровано&#10;в канале" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#cccccc;" vertex="1" parent="1">
          <mxGeometry x="1870" y="280" width="200" height="80" as="geometry" />
        </mxCell>

        <!-- Storage layer (operator) -->
        <mxCell id="store" value="Virtuozzo Storage (реплика 3) — оператор. At-rest шифрование тома (Req. 3.5). Оператор НЕ имеет доступа к ключам/открытому PAN клиента." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;align=center;fontSize=11;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="1120" y="760" width="630" height="60" as="geometry" />
        </mxCell>

        <!-- ===== FLOW 1: AUTHORIZATION (online) — solid green ===== -->
        <mxCell id="a1" value="①авториз: HTTPS 443/tcp&#10;TLS1.3 · PAN+CVV(SAD) в канале" style="endArrow=classic;html=1;strokeColor=#2E7D32;strokeWidth=2;fontColor=#2E7D32;fontSize=10;fontStyle=1;" edge="1" parent="1" source="ch" target="fgt"><mxGeometry relative="1" as="geometry"><mxPoint x="0" y="-10" as="sourcePoint"/></mxGeometry></mxCell>
        <mxCell id="a2" value="①443/tcp passthrough&#10;TLS в канале" style="endArrow=classic;html=1;strokeColor=#2E7D32;strokeWidth=2;fontColor=#2E7D32;fontSize=10;" edge="1" parent="1" source="fgt" target="waf"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="a3" value="①mTLS 8443/tcp&#10;реэнкрипт · PAN+CVV" style="endArrow=classic;html=1;strokeColor=#2E7D32;strokeWidth=2;fontColor=#2E7D32;fontSize=10;" edge="1" parent="1" source="waf" target="app"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="a4" value="①дешифр PAN: PKCS#11/KMIP 5696/tcp" style="endArrow=classic;html=1;strokeColor=#2E7D32;strokeWidth=2;fontColor=#2E7D32;fontSize=10;dashed=1;" edge="1" parent="1" source="app" target="hsm"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="a5" value="①авториз. запрос: TLS1.2+ 443/tcp&#10;mTLS · PAN зашифрован в канале" style="endArrow=classic;html=1;strokeColor=#2E7D32;strokeWidth=2;fontColor=#2E7D32;fontSize=10;fontStyle=1;" edge="1" parent="1" source="app" target="acq"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- ===== FLOW 2: STORE PAN / SETTLEMENT — solid red ===== -->
        <mxCell id="s1" value="②запись PAN: TLS 5432/tcp (db)&#10;PAN→шифр at-rest (3.5.1), SAD удаляется (3.3.1)" style="endArrow=classic;html=1;strokeColor=#C62828;strokeWidth=2;fontColor=#C62828;fontSize=10;fontStyle=1;" edge="1" parent="1" source="app" target="db"><mxGeometry relative="1" as="geometry"><mxPoint x="0" y="20" as="sourcePoint"/></mxGeometry></mxCell>
        <mxCell id="s2" value="②settlement/батч: TLS1.2+ 443/tcp&#10;агрегаты+зашифр PAN → acquirer" style="endArrow=classic;html=1;strokeColor=#C62828;strokeWidth=2;fontColor=#C62828;fontSize=10;exitX=1;exitY=0.7;entryX=0;entryY=0.6;" edge="1" parent="1" source="db" target="acq"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="s3" value="②том БД: blocks → Virtuozzo Storage (зашифр at-rest)" style="endArrow=classic;html=1;strokeColor=#C62828;strokeWidth=1;fontColor=#C62828;fontSize=10;dashed=1;" edge="1" parent="1" source="db" target="store"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- ===== FLOW 3: REFUND/VOID — dashed orange ===== -->
        <mxCell id="r1" value="③refund: HTTPS 443/tcp · токен/последние 4 (без полного PAN)" style="endArrow=classic;html=1;strokeColor=#EF6C00;strokeWidth=2;fontColor=#EF6C00;fontSize=10;dashed=1;fontStyle=1;exitX=0.5;exitY=1;entryX=0.5;entryY=1;" edge="1" parent="1" source="ch" target="waf"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="165" y="430"/><mxPoint x="845" y="430"/></Array></mxGeometry></mxCell>
        <mxCell id="r2" value="③detokenize: TLS 8200/tcp · токен→PAN (в vault)" style="endArrow=classic;html=1;strokeColor=#EF6C00;strokeWidth=2;fontColor=#EF6C00;fontSize=10;dashed=1;" edge="1" parent="1" source="app" target="vault"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="r3" value="③refund→acquirer: TLS1.2+ 443/tcp · PAN зашифр в канале" style="endArrow=classic;html=1;strokeColor=#EF6C00;strokeWidth=2;fontColor=#EF6C00;fontSize=10;dashed=1;exitX=1;exitY=0.85;entryX=0;entryY=0.9;" edge="1" parent="1" source="app" target="acq"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- ===== FLOW 4: TOKENIZATION — dotted purple ===== -->
        <mxCell id="tk1" value="④токенизация: TLS 8200/tcp · PAN→токен" style="endArrow=classic;html=1;strokeColor=#6A1B9A;strokeWidth=2;fontColor=#6A1B9A;fontSize=10;dashed=1;dashPattern=2 4;fontStyle=1;" edge="1" parent="1" source="app" target="vault"><mxGeometry relative="1" as="geometry"><mxPoint x="0" y="-20" as="sourcePoint"/><Array as="points"><mxPoint x="1620" y="150"/></Array></mxGeometry></mxCell>
        <mxCell id="tk2" value="④vault↔HSM: KMIP 5696/tcp · ключи токенизации" style="endArrow=classic;html=1;strokeColor=#6A1B9A;strokeWidth=2;fontColor=#6A1B9A;fontSize=10;dashed=1;dashPattern=2 4;" edge="1" parent="1" source="vault" target="hsm"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="tk3" value="④возврат токена в БД вместо PAN (снижение охвата)" style="endArrow=classic;html=1;strokeColor=#6A1B9A;strokeWidth=1;fontColor=#6A1B9A;fontSize=10;dashed=1;dashPattern=2 4;" edge="1" parent="1" source="vault" target="db"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- MGMT band content -->
        <mxCell id="mg1" value="SIEM оператора (Req. 10) — собирает ТОЛЬКО платформенные логи (панель, гипервизор, FortiGate, bastion). НЕ собирает внутренние логи CDE: их ведёт клиент в своём ROC." style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;fontSize=11;" vertex="1" parent="1">
          <mxGeometry x="80" y="1430" width="560" height="50" as="geometry" />
        </mxCell>
        <mxCell id="mg2" value="Bastion/PAM + MFA (8.4/8.5) — админ-доступ к инфре оператора, НЕ к данным тенанта" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;fontSize=11;" vertex="1" parent="1">
          <mxGeometry x="680" y="1430" width="560" height="50" as="geometry" />
        </mxCell>
        <mxCell id="mg3" value="Virtuozzo Mgmt Panel — управление VM/CT (гипервизор), без доступа к открытому PAN внутри гостя" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;fontSize=11;" vertex="1" parent="1">
          <mxGeometry x="1280" y="1430" width="560" height="50" as="geometry" />
        </mxCell>
        <mxCell id="mgArrow" value="платформенные логи (TLS 6514/tcp syslog): панель/гипервизор/FortiGate → SIEM оператора. Логи ВНУТРИ CDE сюда НЕ поступают." style="endArrow=classic;html=1;strokeColor=#1BA0D7;strokeWidth=1;fontColor=#1BA0D7;fontSize=10;dashed=1;exitX=0.5;exitY=1;entryX=0.5;entryY=0;" edge="1" parent="1" source="mg3" target="mg1"><mxGeometry relative="1" as="geometry"/></mxCell>

        <!-- ===== LEGEND ===== -->
        <mxCell id="legBox" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#333333;" vertex="1" parent="1">
          <mxGeometry x="1840" y="560" width="540" height="470" as="geometry" />
        </mxCell>
        <mxCell id="legT" value="Легенда потоков" style="text;html=1;fontStyle=1;fontSize=13;align=left;" vertex="1" parent="1">
          <mxGeometry x="1860" y="570" width="300" height="24" as="geometry" />
        </mxCell>
        <mxCell id="lg1" value="① Авторизация (online) — сплошная зелёная" style="text;html=1;fontSize=11;align=left;fontColor=#2E7D32;" vertex="1" parent="1">
          <mxGeometry x="1860" y="600" width="500" height="20" as="geometry" />
        </mxCell>
        <mxCell id="lg2" value="② Хранение PAN / settlement — сплошная красная" style="text;html=1;fontSize=11;align=left;fontColor=#C62828;" vertex="1" parent="1">
          <mxGeometry x="1860" y="624" width="500" height="20" as="geometry" />
        </mxCell>
        <mxCell id="lg3" value="③ Возврат/отмена (refund/void) — пунктир оранжевый" style="text;html=1;fontSize=11;align=left;fontColor=#EF6C00;" vertex="1" parent="1">
          <mxGeometry x="1860" y="648" width="500" height="20" as="geometry" />
        </mxCell>
        <mxCell id="lg4" value="④ Токенизация — точечный фиолетовый" style="text;html=1;fontSize=11;align=left;fontColor=#6A1B9A;" vertex="1" parent="1">
          <mxGeometry x="1860" y="672" width="500" height="20" as="geometry" />
        </mxCell>
        <mxCell id="lgState" value="Состояния данных:&#10;• SAD (CVV/track/PIN) — открыто только до авторизации, НЕ хранится (3.3.1)&#10;• PAN в канале — TLS 1.2+/1.3 (4.2.1)&#10;• PAN at-rest — шифрование (3.5.1) + маскирование при выводе (3.4.1)&#10;• Токен — необратим вне vault (снижение охвата)&#10;&#10;Порты (примерные, уточнить по факту):&#10;• 443/tcp — HTTPS/TLS внешн.&#10;• 8443/tcp — mTLS WAF→app&#10;• 5432/tcp — app→БД (TLS)&#10;• 5696/tcp — KMIP к HSM&#10;• 8200/tcp — токен-vault API (TLS)&#10;• 6514/tcp — syslog over TLS&#10;&#10;Границы ответственности:&#10;• Оператор: периметр, VDOM-сегментация, гипервизор, хранилище (at-rest том)&#10;• Тенант: открытый PAN, ключи, приложение, БД, vault, HSM" style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=none;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1860" y="700" width="510" height="320" as="geometry" />
        </mxCell>

        <!-- Scope note -->
        <mxCell id="scopeNote" value="ВАЖНО для охвата (scope): так как полный PAN обрабатывают и хранят клиенты-тенанты, открытые CHD-потоки находятся в зоне ответственности тенанта (его VM/CT). Оператор обеспечивает изоляцию (VDOM+Virtuozzo), периметр, шифрование тома at-rest и раздельность ПЛАТФОРМЕННЫХ логов (A1). Внутренние логи CDE ведёт клиент. Для собственного ROC оператора эти клиентские компоненты — connected-to/impacting scope; для ROC тенанта — его собственный CDE. Точные порты, версии TLS и наличие токенизации/HSM подтвердить по фактической конфигурации." style="text;html=1;fontSize=11;align=left;fillColor=#FFF8E1;strokeColor=#d6b656;verticalAlign=top;spacingLeft=8;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="40" y="1300" width="1780" height="70" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
  <diagram id="migration-3comp" name="6. Миграция: 3 компонента стека VMware">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="2200" pageHeight="1400" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t6" value="PCI DSS 4.0.1 — Significant change: комплексная замена стека VMware (3 компонента) → Virtuozzo + FortiGate. Full reassessment." style="text;html=1;fontSize=17;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="2100" height="26" as="geometry" />
        </mxCell>

        <mxCell id="cHdr" value="Слой стека" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEEEEE;strokeColor=#999999;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="40" y="70" width="300" height="40" as="geometry" /></mxCell>
        <mxCell id="bHdr" value="БЫЛО (VMware)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;fontStyle=1;fontColor=#0B6E99;" vertex="1" parent="1"><mxGeometry x="360" y="70" width="560" height="40" as="geometry" /></mxCell>
        <mxCell id="aHdr" value="СТАЛО (Virtuozzo / FortiGate)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;fontStyle=1;fontColor=#DA291C;" vertex="1" parent="1"><mxGeometry x="940" y="70" width="560" height="40" as="geometry" /></mxCell>
        <mxCell id="rHdr" value="Переоценка (Req.)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;fontStyle=1;fontColor=#8a6d00;" vertex="1" parent="1"><mxGeometry x="1520" y="70" width="620" height="40" as="geometry" /></mxCell>

        <mxCell id="c1" value="① Виртуализация" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEEEEE;strokeColor=#999999;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="40" y="120" width="300" height="90" as="geometry" /></mxCell>
        <mxCell id="b1" value="vSphere / ESXi + vCenter&#10;VMFS / vSAN" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1"><mxGeometry x="360" y="120" width="560" height="90" as="geometry" /></mxCell>
        <mxCell id="a1" value="4× Virtuozzo HS + панель Virtuozzo&#10;Virtuozzo Storage (реплика 3)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1"><mxGeometry x="940" y="120" width="560" height="90" as="geometry" /></mxCell>
        <mxCell id="r1" value="2.2 (харднинг узлов), 1.2, 3.5 (at-rest),&#10;7/8 (RBAC+MFA), 10 (логи), 12.5.1" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="1520" y="120" width="620" height="90" as="geometry" /></mxCell>

        <mxCell id="c2" value="② Оркестрация / портал тенантов" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEEEEE;strokeColor=#999999;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="40" y="220" width="300" height="110" as="geometry" /></mxCell>
        <mxCell id="b2" value="vCloud Director&#10;Organizations / Org VDC&#10;портал самообслуживания, роли тенантов, каталоги, API" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1"><mxGeometry x="360" y="220" width="560" height="110" as="geometry" /></mxCell>
        <mxCell id="a2" value="Штатная панель управления Virtuozzo&#10;(объекты тенантов, портал, RBAC, каталоги образов, API)&#10;НОВЫЙ компонент CDE-периметра" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1"><mxGeometry x="940" y="220" width="560" height="110" as="geometry" /></mxCell>
        <mxCell id="r2" value="A1.1 (изоляция тенантов), 2.2 (харднинг панели),&#10;7.2/7.3 + 8.4/8.5 (доступ/RBAC/MFA),&#10;6.2 (если кастомизирован), 4.2.1 (TLS API), 10/A1.2 (аудит)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="1520" y="220" width="620" height="110" as="geometry" /></mxCell>

        <mxCell id="c3" value="③ Сеть (SDN)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEEEEE;strokeColor=#999999;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="40" y="340" width="300" height="130" as="geometry" /></mxCell>
        <mxCell id="b3" value="NSX-T&#10;overlay + логические сегменты&#10;Distributed Firewall (east-west на vNIC)&#10;edge-шлюзы, микросегментация тенантов" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;" vertex="1" parent="1"><mxGeometry x="360" y="340" width="560" height="130" as="geometry" /></mxCell>
        <mxCell id="a3" value="VDOM на FortiGate 1800F (HA) + VLAN Virtuozzo&#10;EDGE/DMZ/CDE/MGMT/TENANT&#10;north-south и между-VLAN сегментация" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;" vertex="1" parent="1"><mxGeometry x="940" y="340" width="560" height="130" as="geometry" /></mxCell>
        <mxCell id="r3" value="1.2/1.3/1.4 (сегментация, правила),&#10;11.4.5/11.4.6 (тест сегментации заново),&#10;A1.1 (изоляция тенантов), 10/1.2.6 (логи FortiGate)" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFF8E1;strokeColor=#d6b656;align=left;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="1520" y="340" width="620" height="130" as="geometry" /></mxCell>

        <mxCell id="arrow1" style="endArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;" edge="1" parent="1" source="b1" target="a1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="arrow2" style="endArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;" edge="1" parent="1" source="b2" target="a2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="arrow3" style="endArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;" edge="1" parent="1" source="b3" target="a3"><mxGeometry relative="1" as="geometry" /></mxCell>

        <mxCell id="gapBox" value="КЛЮЧЕВОЙ GAP: утрата NSX-T Distributed Firewall (микросегментация east-west на уровне vNIC)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFEBEE;strokeColor=#C62828;strokeWidth=2;fontStyle=1;fontColor=#C62828;verticalAlign=top;align=left;spacingLeft=10;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="40" y="510" width="2100" height="180" as="geometry" />
        </mxCell>
        <mxCell id="gapTxt" value="Проблема: NSX-T DFW фильтровал трафик МЕЖДУ ВМ внутри одного сегмента. VDOM на FortiGate инспектирует трафик north-south и между VLAN, но НЕ внутри одного VLAN.&#10;&#10;Допустимые решения (выбрать и обосновать перед QSA):&#10;  1) Разнести ранее микросегментированные нагрузки по отдельным VLAN → трафик пойдёт через FortiGate VDOM.&#10;  2) Host-based firewall на гостевых ОС для контроля east-west внутри сегмента.&#10;  3) Обосновать анализом рисков, что внутрисегментная изоляция не требуется для однородных равнодоверенных компонентов CDE.&#10;&#10;Подтверждается тестом сегментации (Req. 11.4.5/11.4.6) — как МЕЖДУ сегментами, так и ВНУТРИ сегментов, где ранее работал DFW." style="text;html=1;align=left;fontSize=12;fillColor=none;strokeColor=none;verticalAlign=top;spacingLeft=10;spacingTop=4;" vertex="1" parent="1">
          <mxGeometry x="50" y="540" width="2080" height="150" as="geometry" />
        </mxCell>

        <mxCell id="actHdr" value="Обязательные активности при full reassessment (3 компонента)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#EDE7F6;strokeColor=#9673a6;fontStyle=1;fontColor=#5E35B1;" vertex="1" parent="1">
          <mxGeometry x="40" y="720" width="2100" height="40" as="geometry" />
        </mxCell>
        <mxCell id="act" value="1) Change-record по 3 компонентам с оценкой влияния на охват (6.5.1)   2) Обновить scope, asset inventory, network diagram, dataflow (12.5.1/12.5.2)   3) Харднинг узлов Virtuozzo + панели (бывш. vCD) (2.2)&#10;4) Настроить и задокументировать VDOM-сегментацию; принять решение по замене DFW (1.2-1.4)   5) Переоценить доступ/RBAC тенантов после ухода vCD (7/8)   6) Тест сегментации заново: между и внутри сегментов (11.4.5/11.4.6)&#10;7) Vuln-скан после изменения (11.3.1.3)   8) Подключить новые источники логов: Virtuozzo HS, панель, FortiGate (10)   9) Пересмотреть изоляцию тенантов (A1)   10) ROC/AOC v4.0.1 с QSA — полная переоценка." style="text;html=1;align=left;fontSize=12;fillColor=#FFFFFF;strokeColor=#9673a6;spacingLeft=8;spacingTop=6;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="40" y="770" width="2100" height="120" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
  <diagram id="scope-boundary" name="7. Граница охвата PCI DSS">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="2000" pageHeight="1300" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t7" value="PCI DSS 4.0.1 — Граница охвата (scope). Выделенный CDE: 4 узла Virtuozzo. Общие FortiGate = connected/impacting. Остальное = out-of-scope при изоляции." style="text;html=1;fontSize=16;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1900" height="26" as="geometry" />
        </mxCell>

        <!-- OUT OF SCOPE outer zone -->
        <mxCell id="oos" value="OUT-OF-SCOPE — остальная инфраструктура («общий порядок»). Статус действителен ТОЛЬКО при доказанной изоляции (тест сегментации 11.4.5)." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#F5F5F5;strokeColor=#999999;dashed=1;verticalAlign=top;fontStyle=1;fontColor=#666666;align=left;spacingLeft=10;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="40" y="70" width="1900" height="1180" as="geometry" />
        </mxCell>
        <mxCell id="oos1" value="Прочие серверы / сервисы" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#999999;" vertex="1" parent="1"><mxGeometry x="100" y="1080" width="280" height="60" as="geometry" /></mxCell>
        <mxCell id="oos2" value="Корпоративные сети" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#999999;" vertex="1" parent="1"><mxGeometry x="400" y="1080" width="280" height="60" as="geometry" /></mxCell>
        <mxCell id="oos3" value="Не-платёжные tenant-нагрузки" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#999999;" vertex="1" parent="1"><mxGeometry x="700" y="1080" width="280" height="60" as="geometry" /></mxCell>

        <!-- CONNECTED zone -->
        <mxCell id="conn" value="IN-SCOPE: CONNECTED-TO / SECURITY-IMPACTING — не CDE, но подключены к нему или влияют на безопасность. Применяется ЧАСТЬ требований." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#0B6E99;align=left;spacingLeft=10;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="120" y="180" width="1740" height="840" as="geometry" />
        </mxCell>

        <mxCell id="fgt" value="FortiGate 1800F (HA) — ОБЩИЕ&#10;Сегментация CDE через VDOM&#10;Req. 1.x, 2.2, 10, обзор 1.2.7" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="900" y="220" width="100" height="100" as="geometry" />
        </mxCell>
        <mxCell id="fgtNote" value="Общие для всей инфры → connected/impacting.&#10;VDOM CDE должен доказуемо отделять CDE-трафик." style="text;html=1;fontSize=11;align=left;fillColor=#FFFFFF;strokeColor=#1BA0D7;" vertex="1" parent="1">
          <mxGeometry x="760" y="330" width="380" height="50" as="geometry" />
        </mxCell>

        <mxCell id="panel" value="Панель Virtuozzo&#10;(управление CDE)&#10;2.2,7,8.4/8.5,10,A1" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="180" y="430" width="90" height="80" as="geometry" /></mxCell>
        <mxCell id="siem" value="SIEM/Logs&#10;10.3,7,8" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="340" y="430" width="90" height="80" as="geometry" /></mxCell>
        <mxCell id="bastion" value="Bastion/PAM&#10;7,8.4/8.5,10" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="500" y="430" width="90" height="80" as="geometry" /></mxCell>
        <mxCell id="aaa" value="AAA&#10;8.2/8.3,7" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="660" y="430" width="90" height="80" as="geometry" /></mxCell>
        <mxCell id="ntp" value="NTP&#10;10.6" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1500" y="430" width="90" height="80" as="geometry" /></mxCell>
        <mxCell id="repo" value="Patch/Repo&#10;6.3" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#1BA0D7;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1640" y="430" width="90" height="80" as="geometry" /></mxCell>

        <!-- CDE zone -->
        <mxCell id="cde" value="IN-SCOPE — выделенный кластер (4 узла Virtuozzo HS): МНОЖЕСТВЕННЫЕ тенанты-CDE (CDE-1…CDE-N), каждый со своим ROC. ВСЕ применимые требования внутри каждого CDE — на тенанте." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=3;verticalAlign=top;fontStyle=1;fontColor=#DA291C;align=center;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="560" y="560" width="860" height="380" as="geometry" />
        </mxCell>
        <mxCell id="n1" value="Node-1&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="610" y="620" width="80" height="90" as="geometry" /></mxCell>
        <mxCell id="n2" value="Node-2&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="790" y="620" width="80" height="90" as="geometry" /></mxCell>
        <mxCell id="n3" value="Node-3&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="970" y="620" width="80" height="90" as="geometry" /></mxCell>
        <mxCell id="n4" value="Node-4&#10;Virtuozzo HS" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1150" y="620" width="80" height="90" as="geometry" /></mxCell>
        <mxCell id="cdevz" value="Virtuozzo Storage (реплика 3) — шифрование at-rest (3.5). Только CDE-нагрузки; не-CDE нагрузок на этих узлах НЕТ." style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#DA291C;align=center;" vertex="1" parent="1"><mxGeometry x="610" y="760" width="760" height="50" as="geometry" /></mxCell>
        <mxCell id="cdewl" value="payment-app / API / БД (в применимых сценариях) / HSM (если применим)" style="text;html=1;fontSize=11;align=center;fillColor=none;strokeColor=none;" vertex="1" parent="1"><mxGeometry x="610" y="820" width="760" height="30" as="geometry" /></mxCell>
        <mxCell id="cdectrl" value="In-CDE: FIM/IDS (11.5), AV (5), логи (10), vuln-scan (11.3)" style="text;html=1;fontSize=11;align=center;fillColor=none;strokeColor=none;" vertex="1" parent="1"><mxGeometry x="610" y="855" width="760" height="30" as="geometry" /></mxCell>

        <!-- VDOM boundary arrows -->
        <mxCell id="vd1" value="VDOM CDE: deny-by-default, только нужные потоки" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;fontColor=#DA291C;fontSize=11;fontStyle=1;" edge="1" parent="1" source="fgt" target="cde"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="vd2" value="управление" style="endArrow=classic;html=1;strokeColor=#1BA0D7;fontSize=10;dashed=1;" edge="1" parent="1" source="panel" target="cde"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="vd3" value="изоляция (deny+log)" style="endArrow=none;html=1;strokeColor=#999999;strokeWidth=2;dashed=1;fontColor=#666666;fontSize=11;" edge="1" parent="1" source="conn" target="oos1"><mxGeometry relative="1" as="geometry" /></mxCell>

        <!-- legend -->
        <mxCell id="legBox" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#333333;" vertex="1" parent="1">
          <mxGeometry x="1180" y="560" width="640" height="380" as="geometry" />
        </mxCell>
        <mxCell id="legT" value="Категории охвата" style="text;html=1;fontStyle=1;fontSize=13;align=left;" vertex="1" parent="1"><mxGeometry x="1200" y="570" width="400" height="24" as="geometry" /></mxCell>
        <mxCell id="legBody" value="● CDE (красный, in-scope): 4 узла Virtuozzo, выделены&#10;   только под данные карт → ВСЕ применимые требования.&#10;&#10;● Connected/impacting (синий, in-scope): не CDE, но&#10;   подключены/влияют на безопасность → ЧАСТЬ требований.&#10;   • Общие FortiGate (сегментация через VDOM CDE)&#10;   • Панель Virtuozzo (управление узлами CDE)&#10;   • SIEM, bastion, AAA, NTP, patch-репо&#10;&#10;● Out-of-scope (серый): остальная инфра «общий порядок».&#10;   Статус действителен ТОЛЬКО при доказанной изоляции&#10;   (тест сегментации 11.4.5). Неконтролируемая связность&#10;   с CDE → втягивание в охват.&#10;&#10;Ключевое: FortiGate ОБЩИЕ → они connected/impacting,&#10;а не вне охвата. VDOM CDE обязан доказуемо отделять&#10;CDE-трафик от прочей инфраструктуры." style="text;html=1;fontSize=11;align=left;verticalAlign=top;fillColor=none;strokeColor=none;spacingLeft=6;" vertex="1" parent="1">
          <mxGeometry x="1200" y="598" width="600" height="330" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
  <diagram id="multi-cde" name="8. Multi-CDE: каждый тенант — отдельный CDE">
    <mxGraphModel dx="1422" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="2200" pageHeight="1400" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="t8" value="PCI DSS 4.0.1 — Multi-CDE: каждый тенант = самостоятельный CDE со своим ROC. Изоляция: свой VLAN + свой VDOM на FortiGate. Граница проходит МЕЖДУ платёжными окружениями." style="text;html=1;fontSize=16;fontStyle=1;align=left;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="2100" height="26" as="geometry" />
        </mxCell>

        <!-- Platform boundary -->
        <mxCell id="platform" value="Платформа оператора (multi-CDE service provider): 4 узла Virtuozzo HS + общие FortiGate 1800F (HA). Connected/impacting. Отвечает за изоляцию CDE друг от друга (A1)." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#0B6E99;align=left;spacingLeft=10;spacingTop=8;" vertex="1" parent="1">
          <mxGeometry x="40" y="70" width="2120" height="1180" as="geometry" />
        </mxCell>

        <!-- FortiGate central -->
        <mxCell id="fgt" value="FortiGate 1800F (HA)&#10;VDOM на каждый тенант-CDE&#10;deny-by-default между CDE" style="sketch=0;html=1;shape=mxgraph.fortinet.fortigate;fillColor=#DA291C;strokeColor=none;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1">
          <mxGeometry x="1010" y="150" width="120" height="120" as="geometry" />
        </mxCell>

        <!-- CDE tenant 1 -->
        <mxCell id="cde1" value="ТЕНАНТ-CDE №1 — отдельный CDE, свой ROC&#10;VLAN 101 · VDOM tenant1" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=3;verticalAlign=top;fontStyle=1;fontColor=#DA291C;align=left;spacingLeft=10;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="120" y="330" width="600" height="380" as="geometry" />
        </mxCell>
        <mxCell id="c1v1" value="VM/CT&#10;payment-app" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="160" y="390" width="80" height="80" as="geometry" /></mxCell>
        <mxCell id="c1v2" value="БД PAN&#10;(тенант 1)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="320" y="390" width="80" height="80" as="geometry" /></mxCell>
        <mxCell id="c1note" value="Свой охват, свой dataflow, свой ROC.&#10;Свои ключи/механизм защиты PAN.&#10;In-CDE: FIM/IDS, AV, логи, vuln-scan." style="text;html=1;fontSize=11;align=left;fillColor=#FFFFFF;strokeColor=#DA291C;verticalAlign=top;spacingLeft=6;spacingTop=4;" vertex="1" parent="1"><mxGeometry x="160" y="500" width="500" height="180" as="geometry" /></mxCell>

        <!-- CDE tenant 2 -->
        <mxCell id="cde2" value="ТЕНАНТ-CDE №2 — отдельный CDE, свой ROC&#10;VLAN 102 · VDOM tenant2" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=3;verticalAlign=top;fontStyle=1;fontColor=#DA291C;align=left;spacingLeft=10;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="1480" y="330" width="600" height="380" as="geometry" />
        </mxCell>
        <mxCell id="c2v1" value="VM/CT&#10;payment-app" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=server;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1520" y="390" width="80" height="80" as="geometry" /></mxCell>
        <mxCell id="c2v2" value="БД PAN&#10;(тенант 2)" style="sketch=0;html=1;shape=mxgraph.cisco19.rect;prIcon=storage_array;fillColor=#FFFFFF;strokeColor=#DA291C;verticalLabelPosition=bottom;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1680" y="390" width="80" height="80" as="geometry" /></mxCell>
        <mxCell id="c2note" value="Свой охват, свой dataflow, свой ROC.&#10;Свои ключи/механизм защиты PAN.&#10;In-CDE: FIM/IDS, AV, логи, vuln-scan." style="text;html=1;fontSize=11;align=left;fillColor=#FFFFFF;strokeColor=#DA291C;verticalAlign=top;spacingLeft=6;spacingTop=4;" vertex="1" parent="1"><mxGeometry x="1520" y="500" width="500" height="180" as="geometry" /></mxCell>

        <!-- CDE tenant N -->
        <mxCell id="cden" value="ТЕНАНТ-CDE №N — отдельный CDE, свой ROC · VLAN 10N · VDOM tenantN  (масштабируется на N тенантов)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=2;dashed=1;verticalAlign=top;fontStyle=1;fontColor=#DA291C;align=left;spacingLeft=10;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="120" y="690" width="940" height="50" as="geometry" />
        </mxCell>

        <!-- connections with deny boundary -->
        <mxCell id="e1" value="VLAN 101 / VDOM tenant1" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;fontColor=#DA291C;fontSize=11;" edge="1" parent="1" source="fgt" target="cde1"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="e2" value="VLAN 102 / VDOM tenant2" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;fontColor=#DA291C;fontSize=11;" edge="1" parent="1" source="fgt" target="cde2"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="edeny" value="CDE-1 ⇄ CDE-2: DENY (deny-by-default, трафик инспектируется FortiGate)" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#C62828;strokeWidth=2;dashed=1;fontColor=#C62828;fontSize=12;fontStyle=1;" edge="1" parent="1" source="cde1" target="cde2"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="900" y="300"/><mxPoint x="1300" y="300"/></Array></mxGeometry></mxCell>

        <!-- storage -->
        <mxCell id="store" value="Virtuozzo Storage — раздельные тома/namespace на тенант-CDE, шифрование at-rest (3.5). Запрет cross-CDE доступа." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#E3F2FD;strokeColor=#1BA0D7;align=center;fontSize=11;verticalAlign=middle;" vertex="1" parent="1">
          <mxGeometry x="120" y="745" width="940" height="40" as="geometry" />
        </mxCell>

        <!-- legend -->
        <mxCell id="legBox" value="" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#333333;" vertex="1" parent="1">
          <mxGeometry x="120" y="975" width="1960" height="250" as="geometry" />
        </mxCell>
        <mxCell id="legT" value="Модель Multi-CDE — ключевые принципы" style="text;html=1;fontStyle=1;fontSize=13;align=left;" vertex="1" parent="1"><mxGeometry x="140" y="985" width="800" height="24" as="geometry" /></mxCell>
        <mxCell id="legBody" value="● Каждый тенант = ОТДЕЛЬНЫЙ CDE с собственным охватом, dataflow и ROC. Оператор НЕ объединяет тенантов под единый ROC.&#10;● Изоляция между CDE: свой VLAN + свой VDOM на FortiGate; deny-by-default. Межтенантный трафик ВСЕГДА инспектируется FortiGate (нет общего L2-домена между CDE).&#10;● Утрата NSX-T DFW не критична для границы МЕЖДУ CDE: раз каждый CDE в своём VLAN, межтенантный трафик не «внутри одного VLAN». Внутрисегментная микросегментация — задача внутри каждого тенанта-CDE.&#10;● Оператор = multi-CDE service provider: отвечает за платформенную изоляцию CDE, предоставляет каждому тенанту evidence (AOC + свидетельства) для его ROC (12.9.2).&#10;● Тест сегментации (11.4.5) покрывает границы между ВСЕМИ тенантами-CDE; объём масштабируется с числом тенантов. Для SP — каждые 6 мес. и после изменений.&#10;● Логирование: оператор ведёт ТОЛЬКО платформенные логи (панель, гипервизор, FortiGate) раздельно по тенантам (A1.2). Внутренние логи каждого CDE ведёт сам клиент в своём ROC — оператор доступа внутрь CDE не имеет." style="text;html=1;fontSize=11;align=left;verticalAlign=top;fillColor=none;strokeColor=none;spacingLeft=8;spacingTop=4;" vertex="1" parent="1">
          <mxGeometry x="140" y="1013" width="1920" height="205" as="geometry" />
        </mxCell>
        <mxCell id="cde3box" value="ТЕНАНТ-CDE №3 — VLAN 103 · VDOM tenant3 (свой ROC)" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FDECEA;strokeColor=#DA291C;strokeWidth=2;verticalAlign=middle;fontStyle=1;fontColor=#DA291C;align=center;" vertex="1" parent="1">
          <mxGeometry x="120" y="760" width="940" height="60" as="geometry" />
        </mxCell>
        <mxCell id="denyMx" value="Матрица межтенантного взаимодействия (east-west) — DENY-ALL" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#FFEBEE;strokeColor=#C62828;strokeWidth=2;verticalAlign=top;fontStyle=1;fontColor=#C62828;align=center;spacingTop=6;" vertex="1" parent="1">
          <mxGeometry x="1100" y="760" width="980" height="170" as="geometry" />
        </mxCell>
        <mxCell id="mxh0" value="От \ К" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1120" y="800" width="200" height="28" as="geometry" /></mxCell>
        <mxCell id="mxh1" value="CDE-1" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1320" y="800" width="240" height="28" as="geometry" /></mxCell>
        <mxCell id="mxh2" value="CDE-2" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1560" y="800" width="240" height="28" as="geometry" /></mxCell>
        <mxCell id="mxh3" value="CDE-N" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1800" y="800" width="260" height="28" as="geometry" /></mxCell>
        <mxCell id="mxr1" value="CDE-1" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1120" y="828" width="200" height="32" as="geometry" /></mxCell>
        <mxCell id="m11" value="(внутри CDE-1)" style="rounded=0;html=1;fillColor=#FDECEA;strokeColor=#C62828;fontSize=10;" vertex="1" parent="1"><mxGeometry x="1320" y="828" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m12" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1560" y="828" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m13" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1800" y="828" width="260" height="32" as="geometry" /></mxCell>
        <mxCell id="mxr2" value="CDE-2" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1120" y="860" width="200" height="32" as="geometry" /></mxCell>
        <mxCell id="m21" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1320" y="860" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m22" value="(внутри CDE-2)" style="rounded=0;html=1;fillColor=#FDECEA;strokeColor=#C62828;fontSize=10;" vertex="1" parent="1"><mxGeometry x="1560" y="860" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m23" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1800" y="860" width="260" height="32" as="geometry" /></mxCell>
        <mxCell id="mxr3" value="CDE-N" style="rounded=0;html=1;fillColor=#FFFFFF;strokeColor=#C62828;fontSize=11;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1120" y="892" width="200" height="32" as="geometry" /></mxCell>
        <mxCell id="m31" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1320" y="892" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m32" value="DENY + log" style="rounded=0;html=1;fillColor=#FFCDD2;strokeColor=#C62828;fontSize=10;fontStyle=1;" vertex="1" parent="1"><mxGeometry x="1560" y="892" width="240" height="32" as="geometry" /></mxCell>
        <mxCell id="m33" value="(внутри CDE-N)" style="rounded=0;html=1;fillColor=#FDECEA;strokeColor=#C62828;fontSize=10;" vertex="1" parent="1"><mxGeometry x="1800" y="892" width="260" height="32" as="geometry" /></mxCell>
        <mxCell id="e3conn" value="VLAN 103 / VDOM tenant3" style="endArrow=classic;startArrow=classic;html=1;strokeColor=#DA291C;strokeWidth=2;fontColor=#DA291C;fontSize=10;" edge="1" parent="1" source="fgt" target="cde3box"><mxGeometry relative="1" as="geometry" /></mxCell>
        <mxCell id="denyNote" value="Вне диагонали — ВСЕГДА DENY. Между тенантами-CDE НЕ настраивается ни одного разрешающего правила (исключения = significant change + переоценка охвата). Разрешены только вертикальные потоки: tenant-CDE → свой acquirer и → общие connected-сервисы (NTP/AAA/логи)." style="text;html=1;fontSize=10;align=left;fillColor=#FFFFFF;strokeColor=#C62828;verticalAlign=top;spacingLeft=6;spacingTop=4;" vertex="1" parent="1">
          <mxGeometry x="1100" y="935" width="980" height="20" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
