Network Connection
PCIComplianceHubLast updated
A path, whether physical, logical or virtual, between two devices along which network packets can travel. In PCI DSS every connection into or out of the CDE is something to be diagrammed, controlled and approved, because each is a way in.
Applies to. Every entity with a CDE that connects to anything, which is every entity with a CDE.
Example. A VPN from a support vendor into the payment network, a VLAN trunk between the office and the card-processing segment, and an API integration to a fraud service are all network connections. 1.2.2 requires a change to any of them to be approved and managed; 1.2.3 requires them to appear on the network diagram.
Limits. Logical and virtual connections count the same as cables: a peering between two cloud virtual networks is a connection. An undocumented connection is the classic way a segmented scope turns out to be larger than the assessment assumed, which is why 1.2.3 requires the diagram to show all connections between the CDE and other networks, including wireless, and 11.4.5 tests that the segmentation holds.