1.4 Network connections between trusted and untrusted networks are controlled
How to meet it
Place NSCs at the boundary and restrict inbound/outbound traffic to what is authorised.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 1.4, in plain English.
1.4.1NSCs are installed between trusted and untrusted networks.
1.4.2Inbound traffic from untrusted to trusted networks is limited to authorized public-facing communications and stateful responses, with all else denied.
1.4.3Anti-spoofing measures detect and block packets with forged source IP addresses entering the trusted network.
1.4.4System components that store cardholder data are not directly reachable from untrusted networks.
1.4.5Disclosure of internal IP addresses and routing information is restricted to authorized parties only.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Network security policyUse for ISO 27001 A.8.20, A.8.21, A.8.22, A.8.23, SOC 2 Security, and PCI DSS requirements 1 and 4.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.
Open the control-to-policy map← 1.3 Network access to and from the CDE is restricted1.5 Risks from devices connecting to both untrusted networks and the CDE are mitigated →
Back to Requirement 1, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.