Router

Applies to. PCI DSS v4.0.1 does not name routers in its requirement text; Requirement 1 speaks of network security controls (NSCs), and the standard's scope section lists routers among the network components that are system components. A router that filters traffic at a CDE or trusted-network boundary is assessed as an NSC: the guidance to 1.2.1 gives routers configured with access control lists as an example, its configuration changes go through change control, and 1.2.8's guidance uses a router whose configuration is stored in non-volatile memory as its example of why configuration files must match the running device. Physical access to networking hardware inside the facility is restricted under Requirement 9.

Limits. Routing inside a single trusted network is not what Requirement 1 controls; the requirement bites at the boundary between trusted and untrusted networks and between the CDE and any other network, wireless included.