PCI DSS Requirement 1: Network Security Controls Explained

Requirement 1 Structure

Must-Implement Controls

• 1.2.1-1.2.2 - NSC ruleset standards defined, implemented, maintained; connection/config changes approved under the 6.5.1 change process.
• 1.2.3 / 1.2.4 - Current network diagram (all CDE connections, including wireless) and data-flow diagram (account data paths), updated on change.
• 1.2.5-1.2.6 - Allowed services/protocols/ports identified with business need; insecure protocols get compensating security features.
• 1.2.7 - NSC configs reviewed at least every six months.
• 1.2.8 - Configuration files secured and kept consistent with active configs (includes IaC/scripts).
• 1.3.1 / 1.3.2 - Inbound and outbound CDE traffic limited to necessary flows; all other traffic denied.
• 1.3.3 - NSCs between wireless networks and the CDE; wireless into CDE denied by default except authorized business purpose.
• 1.4.1-1.4.5 - NSCs between trusted/untrusted; restrict inbound from untrusted; anti-spoofing; CHD stores not directly reachable from untrusted; limit disclosure of internal IPs/routing.
• 1.5.1 - Security controls on company- and employee-owned devices that connect to both untrusted networks and the CDE; controls running and not user-alterable without documented authorization.

Common Failures

Stale network or data-flow diagrams; broad outbound “permit any” from the CDE; wireless bridged into the CDE without an NSC; dual-homed laptops that can reach the Internet and the CDE without enforced endpoint controls.

How CyberSilo Helps

• Network configuration assessment - surface NSC and CDE-boundary gaps
• Compliance Standards Automation - map Requirement 1 artefacts to ongoing evidence

Frequently Asked Questions

Does Requirement 1 only mean traditional firewalls?

No. PCI DSS v4.0.1 uses network security controls (NSCs) - firewalls, cloud security groups, routers, and equivalent controls that enforce the CDE boundary.

How often must NSC configurations be reviewed?

Requirement 1.2.7 requires NSC configurations to be reviewed at least once every six months to confirm they remain relevant and effective.

What diagrams does Requirement 1 expect?

An accurate network diagram (1.2.3) showing CDE connections including wireless, and a data-flow diagram (1.2.4) showing account data flows, updated when the environment changes.

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services