PCI DSS v4.0/Requirement 01: Install and Maintain Network Security Controls/18 of 250
1.5.1Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated
Control family: Requirement 01: Install and Maintain Network Security Controls
Control description
Defined Approach Requirements:
Security controls are implemented on any computing devices that connect to both untrusted networks (including the Internet) and the CDE as follows:
- specific configuration settings are defined to prevent threats being introduced into the entity's network.
- security controls are actively running.
- security controls are not alterable by users of the computing devices unless specifically documented and authorized by management on a case-by-case basis for a limited period.
Defined Approach Testing Procedures:
1.5.1.a Examine policies and configuration standards and interview personnel to verify security controls for computing devices that connect to both untrusted networks, and the CDE, are implemented in accordance with all elements specified in this requirement.
1.5.1.b Examine configuration settings on computing devices that connect to both untrusted networks and the CDE to verify settings are implemented in accordance with all elements specified in this requirement.