PCI DSS v4.0/Requirement 01: Install and Maintain Network Security Controls/12 of 250
1.3.2Network access to and from the cardholder data environment is restricted
Control family: Requirement 01: Install and Maintain Network Security Controls
Control description
Defined Approach Requirements:
Outbound traffic from the CDE is restricted as follows:
- To only the traffic that is necessary.
- All other traffic is specifically denied.
Defined Approach Testing Procedures:
1.3.2.a Examine configuration standards for NSCs to verify that they define restricting outbound traffic from the CDE in accordance with all elements specified in this requirement.
1.3.2.b Examine configurations of NSCs to verify that outbound traffic from the CDE is restricted in accordance with all elements specified in this requirement.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.