1.3 Network access to and from the CDE is restricted
How to meet it
Allow only necessary traffic in and out of the CDE; deny all else by default.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 1.3, in plain English.
1.3.1Inbound traffic to the CDE is limited to only what is necessary, with everything else blocked.
1.3.2Outbound traffic from the CDE is limited to only what is necessary, with everything else blocked.
1.3.3NSCs sit between all wireless networks and the CDE, blocking wireless traffic by default and allowing only approved traffic.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Network security policyUse for ISO 27001 A.8.20, A.8.21, A.8.22, A.8.23, SOC 2 Security, and PCI DSS requirements 1 and 4.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 1.2 NSCs are configured and maintained1.4 Network connections between trusted and untrusted networks are controlled →
Back to Requirement 1, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.