PCI DSS v4.0/Requirement 01: Install and Maintain Network Security Controls/7 of 250
1.2.5Network security controls (NSCs) are configured and maintained
Control family: Requirement 01: Install and Maintain Network Security Controls
Control description
Defined Approach Requirements:
All services, protocols, and ports allowed are identified, approved, and have a defined business need.
Defined Approach Testing Procedures:
1.2.5.a Examine documentation to verify that a list exists of all allowed services, protocols, and ports, including business justification and approval for each.
1.2.5.b Examine configuration settings for NSCs to verify that only approved services, protocols, and ports are in use.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.