Virtual Private Network (VPN)

Applies to. PCI DSS treats a VPN as a form of remote access; the Council's remote access definition names it as the example technology. That puts VPN logins under 8.4.3, which requires MFA for all remote access from outside the entity's network that could access or impact the CDE. It also puts the VPN gateway in scope as a system component, since it is a way into the network, and any third-party VPN accounts under 8.2.7: enabled only for the period needed, disabled otherwise, and monitored for unexpected activity.

Example. A merchant's IT contractor supports the back-office server from the contractor's own premises over a VPN. The VPN account exists only for that contractor, is enabled by the merchant while a support ticket is open and disabled afterwards, and the login needs a password plus a one-time code. That covers 8.2.7 for the account and 8.4.3 for the MFA; the merchant also keeps the session logs so unexpected activity can be spotted.

Limits. A VPN protects the path, not the endpoint. Once the tunnel is up, the connecting device is on the private network with whatever it brought along, which is why 1.5.1 wants security controls on any device that connects to both an untrusted network and the CDE. A VPN is not MFA and does not satisfy 8.4.3 on its own; the second factor has to be applied at the VPN login or on the systems reached through it. And a site-to-site VPN between two networks the entity controls is a network connection, not remote access in the standard's sense, since remote access means a session that starts outside the entity's network.