Untrusted Network

Applies to. The internet is the obvious untrusted network, and 1.5.1 names it. Guest Wi-Fi, a partner's network, a mobile carrier's network and any other segment the entity cannot control or manage count too. Four Requirement 1 controls turn on the term: 1.4.1 requires an NSC between trusted and untrusted networks, 1.4.2 restricts what may come in from an untrusted network to authorised public services and stateful replies, 1.4.4 keeps systems that store cardholder data off any direct path from an untrusted network, and 1.5.1 requires security controls on any device that connects to both an untrusted network and the CDE.

Example. A merchant's finance staff take laptops home, connect to home broadband, then come back and plug into the office network that reaches the card data store. Home broadband is an untrusted network. Under 1.5.1 those laptops need defined security settings that run all the time and that staff cannot switch off, because a device that moves between the two networks is the path by which something on the untrusted side reaches the CDE.

Limits. Untrusted is a control statement, not a threat rating. A network is untrusted because the entity cannot control or manage it, not because it is known to be hostile; a reputable partner's private link is still untrusted. Encrypting traffic across an untrusted network protects the data in transit; it does not make the network trusted or remove the need for the NSC at the boundary under 1.4.1. The Requirement 1 overview also treats an entity's own networks that are out of scope for PCI DSS as untrusted, because their controls are not assessed, so an office LAN is not automatically on the trusted side.