Unified Threat Management (UTM)

Applies to. PCI DSS v4.0.1 does not name UTM in its requirements. A UTM appliance is assessed by each function it performs: as an NSC it falls under Requirement 1 (placement between trusted and untrusted networks, traffic restriction, change control and secured configuration files), and as anti-malware it must perform periodic and active scans or continuous behavioural analysis under Requirement 5. Each function is also its own critical security control system under Requirement 10, whose failure must be detected and alerted, and whose alerts the incident response plan must cover.

Limits. Consolidating functions into one device does not consolidate the requirements; NSC, IDS/IPS and anti-malware are listed separately among the critical security control systems whose failure must be detected, so one device failing is expected to be noticed as a failure of each.