Network

Applies to. Requirement 1 is built around the network: an accurate network diagram must show every connection between the CDE and other networks, including wireless (1.2.3); changes to network connections go through change control (1.2.2); and NSCs sit between trusted and untrusted networks (1.4.1) and between all wireless networks and the CDE (1.3.3). Inbound traffic from untrusted networks is limited to authorised public services and stateful responses, with all other traffic denied (1.4.2). Requirement 4 adds that PAN sent over open, public networks is protected with strong cryptography (4.2.1).

Limits. Requirement 1 does not prescribe a network technology or layout; it asks that the boundaries between the CDE, trusted networks and untrusted networks are documented in configuration standards and network diagrams and enforced by NSCs (1.4.1).