Install and maintain network security controls
Requirement 1 requires organizations to implement and manage network security controls (NSCs) that restrict traffic between the Cardholder Data Environment (CDE) and other networks. The primary goal is to ensure only necessary, documented communication is permitted while all other traffic is denied by default.
What it means
In practice, this requirement moves beyond traditional hardware firewalls to include any technology—such as cloud security groups, software-defined networking, or access control lists (ACLs)—that filters network traffic. The intent is to create a secure perimeter around sensitive payment data to minimize the attack surface and prevent unauthorized lateral movement within the network.
Scope extends to both inbound traffic entering the CDE and outbound traffic leaving it. Organizations must explicitly define what traffic is allowed based on business needs; any communication path that does not have a documented business justification should be blocked.
How to meet it
- Establish a "deny all" default rule for all network traffic, ensuring only specifically permitted protocols and ports are opened.
- Create a detailed inventory of all authorized services, protocols, and ports required for business operations within the CDE.
- Implement strict outbound filtering to ensure that systems in the CDE can only communicate with external entities necessary for their function.
- Document the business justification for every open port and service permitted through the security controls.
- Establish a formal process to review network security control configurations at regular intervals to identify and remove obsolete or insecure rules.
- Ensure that any new network connections are reviewed and approved before being implemented in production.
Evidence an auditor asks for
- Current, detailed network diagrams showing all connections between the CDE and other networks, including all traffic flows.
- Configuration files or exported rule sets from firewalls, cloud security groups, or routers proving "deny all" defaults and specific allow-rules.
- A business justification matrix that maps every open port/protocol to a specific operational requirement.
- Records of the periodic reviews of network security controls, including dates of review and evidence of any changes made as a result.
Common pitfalls
- Using overly permissive "Any" rules for source or destination addresses, which violates the principle of least privilege.
- Maintaining outdated network diagrams that do not reflect the actual current state of the production environment.
- Focusing exclusively on inbound traffic while neglecting to restrict and document outbound (egress) traffic from the CDE.
- Failing to maintain a written justification for rules, leaving the auditor to guess why a specific port is open.