PCI DSS Requirement 1 - Install and Maintain Network Security Controls

Requirement 1 of PCI DSS asks you to protect your card data environment with network security controls, such as firewalls, virtual firewalls, or cloud security groups, that block all traffic except what your business actually needs. You must keep up-to-date network and data-flow diagrams, record a business reason for every rule that lets traffic through, review your rules at least every six months, keep systems that store card data off the internet, and secure laptops and other devices that connect to both the internet and the card data environment.

What is a network security control?

A network security control (NSC) is anything that examines traffic entering or leaving a network segment and decides, based on rules you set, whether to let it pass. Older versions of PCI DSS said "firewalls and routers". Version 4.0 switched to the broader term because a lot of networks now live in the cloud, where the control might be a cloud security group or a virtual firewall rather than a box in a rack. For a small business, a single stateful firewall with separate zones and strict access control lists (ACLs) can meet the requirement.

What documentation does Requirement 1 need?

Requirement 1.2.1 asks for configuration standards for your NSC rule sets, and 1.2.2 says changes to network connections and NSC settings go through your change control process under Requirement 6.5.1. Requirement 1.2.3 asks for an accurate network diagram showing every connection between the card data environment and other networks, including wireless. Requirement 1.2.4 asks for an accurate data-flow diagram showing how card data moves across your systems and networks. Both diagrams must be updated whenever the environment changes.

How often should firewall rules be reviewed?

At least once every six months, under Requirement 1.2.7. Requirement 1.2.5 says every allowed service, protocol, and port must be identified, approved, and tied to a defined business need. If you allow something insecure, Requirement 1.2.6 asks for extra security features to reduce the risk. The six-month review is where you find the rules nobody can explain anymore: the port opened for a vendor two years ago, or an "allow any" rule added during an outage and never removed. Requirement 1.2.8 also asks that NSC configuration files are secured and kept consistent with the running configuration, so a reboot doesn't quietly load an old rule set.

What traffic is allowed in and out of the card data environment?

Only what you need. Requirement 1.3.1 says inbound traffic to the card data environment is limited to what is necessary, and everything else is denied. Requirement 1.3.2 says the same for outbound traffic. A server that holds card data rarely needs to open connections to the whole internet, and blocking that makes it much harder for malware to send stolen data out. Requirement 1.3.3 says NSCs must sit between every wireless network and the card data environment, with wireless traffic into it denied by default.

What is a DMZ and why do I need one?

Some systems have to be reachable from the internet by design, such as a web server, a mail server, an API server, or a VPN server. That makes them easier to attack than systems nobody outside can reach. A demilitarized zone (DMZ) is a separate network segment for these public-facing systems, with controls between it and both the internet and your internal networks. If an attacker breaks into a web server in the DMZ, they still face another set of controls before they reach anything sensitive. A DMZ is a common way to meet Requirements 1.4.1 and 1.4.2, which ask for NSCs between trusted and untrusted networks and limit inbound traffic from untrusted networks to systems that provide public services. Requirement 1.4.4 says systems that store card data must not be directly reachable from untrusted networks, so the database never belongs in the DMZ.

What else does Requirement 1.4 ask for?

Requirement 1.4.3 asks for anti-spoofing measures, so traffic arriving from the internet that pretends to come from inside your network is dropped. Requirement 1.4.5 asks you to limit who can see your internal IP addresses and routing information, since a map of your internal network is useful to an attacker.

Do laptops need a personal firewall?

Any device that connects to both an untrusted network, like home Wi-Fi or the internet, and the card data environment needs its own security controls under Requirement 1.5.1. That applies to company-owned and employee-owned devices alike. The settings must be defined, actively running, and not changeable by the user unless management documents and approves it for a specific case and a limited time. In practice that usually means the firewall built into Windows or macOS, managed centrally so staff can't switch it off.

How does an ASV scan check Requirement 1?

A quarterly external scan under Requirement 11.3.2 tests your firewall from the outside, the way an attacker would. It checks every TCP port and the common UDP ports on each public address, and reports services that shouldn't be reachable, such as remote desktop, a database, or an old file transfer service. It can't see your internal rules, but it shows whether the rules you think you have are actually working at the edge. ServerScan is a PCI Approved Scanning Vendor. Our guide to common scan failures covers open-port findings, and the pricing page shows what a plan includes.

Go on to Requirement 2 - Vendor Defaults.

Read more about Selecting a PCI DSS Compliant Firewall.