Wireless Local Area Network (WLAN)

Applies to. PCI DSS v4.0.1 says wireless network rather than WLAN. Requirement 1 places NSCs between all wireless networks and the CDE, whether or not the wireless network is itself part of the CDE, so that wireless traffic into the CDE is denied by default and allowed only for an authorised business purpose, and the network diagram must show wireless connections. Requirement 2 asks that wireless vendor defaults are changed or confirmed secure where the wireless environment connects to the CDE or carries account data, and Requirement 4 asks that wireless networks transmitting PAN or connected to the CDE use industry best practice strong cryptography for authentication and transmission.

Limits. A wireless network that carries no account data and is not in the CDE is still subject to the NSC requirement at its boundary with the CDE; the standard's wording is regardless of whether the wireless network is a CDE.