Zone-based Firewall
PCIComplianceHubLast updated
A type of firewall configuration that segments a network into multiple security zones, each with its own policies and rules. Zone-based firewalls can help organizations protect sensitive data, such as cardholder data, by restricting access to specific network segments, which supports PCI DSS compliance.
Applies to. PCI DSS v4.0.1 does not name zone-based firewalls or any firewall type in its requirements; it uses network security control (NSC) for whatever enforces traffic policy between networks. The zone model maps onto Requirement 1 directly: NSCs sit between trusted and untrusted networks and between all wireless networks and the CDE, inbound traffic from untrusted networks is limited to authorised public services and stateful responses with all else denied, and NSC configuration changes and configuration files are controlled.
Limits. The zones a vendor labels trusted and untrusted are not the standard's zones; the entity decides which networks it treats as trusted and must show that in its configuration standards and network diagrams, with the NSCs defined between them.
Related. Network Security Control (NSC), Firewall, Trusted Network, Untrusted Network, Firewall Rule
Sources. PCI DSS v4.0.1 (June 2024)