Quality of Service (QoS)

PCIComplianceHubLast updated

A set of network techniques that prioritise some traffic over other traffic so that throughput, delay and loss stay within limits for the traffic that matters. PCI DSS v4.0.1 does not name QoS and sets no availability or performance targets; QoS matters to PCI DSS only as part of the configuration of a network security control.

Applies to. PCI DSS v4.0.1 does not name quality of service in its requirements, and it sets no availability or performance targets; it is a data security standard. QoS comes up only indirectly: QoS settings on a network security control are part of its configuration, so changes to them go through the change control process and the configuration files that hold them are secured and kept consistent with the running device.
Limits. A QoS shortfall is not a PCI DSS finding; the standard asks what traffic an NSC permits and denies, not how fast it carries it.
Related. Network, Network Security Control (NSC), High Availability, Failover, Network Connection
Sources. PCI DSS v4.0.1 (June 2024)