Defined Approach Requirements
1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.
Customized Approach Objective
NSC configurations that allow or restrict access to trusted networks are verified periodically to ensure that only authorized connections with a current business justification are permitted.
Applicability Notes
[No detail is provided here in the PCI DSS 4.0]
Defined Approach Testing Procedures
1.2.7.a Examine documentation to verify procedures are defined for reviewing configurations of NSCs at least once every six months.
1.2.7.b Examine documentation of reviews of configurations for NSCs and interview responsible personnel to verify that reviews occur at least once every six months.
1.2.7.c Examine configurations for NSCs to verify that configurations identified as no longer being supported by a business justification are removed or updated.
Purpose of requirement and procedures
Such a review gives the organization an opportunity to clean up any unneeded, outdated, or incorrect rules and configurations which could be utilized by an unauthorized person. Furthermore, it ensures that all rules and configurations allow only authorized services, protocols, and ports that match the documented business justifications.
Good practice
This review, which can be implemented using manual, automated, or system-based methods, is intended to confirm that the settings that manage traffic rules, what is allowed in and out of the network, match the approved configurations.
The review should provide confirmation that all permitted access has a justified business reason. Any discrepancies or uncertainties about a rule or configuration should be escalated for resolution.
While this requirement specifies that this review occur at least once every six months, organizations with a high volume of changes to their network configurations may wish to consider performing reviews more frequently to ensure that the configurations continue to meet the needs of the business.
Definitions
[No detail is provided here in the PCI DSS 4.0]
Note: This sub-requirement requirement falls within the primary PCI DSS Requirement 1: Install and Maintain Network Security Controls and secondary requirement 1.2 Network security controls (NSCs) are configured and maintained..
What is the PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards formed in 2004 by Visa, MasterCard, Discover Financial Services, JCB International and American Express. Governed by the Payment Card Industry Security Standards Council (PCI SSC), the compliance scheme aims to secure credit and debit card transactions against data theft and fraud.
While the PCI SSC has no legal authority to compel compliance, it is a requirement for any business that processes credit or debit card transactions. PCI certification is also considered the best way to safeguard sensitive data and information, thereby helping businesses build long lasting and trusting relationships with their customers.
Source: https://www.imperva.com/learn/data-security/pci-dss-certification/
What is the PCI SSC
The PCI SSC mission is to enhance global payment account data security by developing standards and supporting services that drive education, awareness, and effective implementation by stakeholders. We achieve this with a strategic framework to guide our decision-making process and ensure that every initiative is aligned with our mission and supports the needs of the global payments industry.
The four pillars of our strategic framework include:
- Increase industry participation and knowledge in the PCI Standards development process and stakeholder support for standards implementation. This ensures that standards and resources reflect and address industry needs and challenges.
- Evolve security standards and validation programs to support a range of environments, technologies and methodologies for achieving security. This ensures standards and resources that support and enable safe commerce and the flexibility to use different approaches to meet those standards.
- Secure emerging payment channels via development of PCI Standards and resources to support broader payment acceptance. This enables safe commerce in new and emerging card and card-based payment channels such as mobile and internet-of-things.
- Increase standards alignment and consistency of PCI Standards to minimize redundancy and support effective implementation.
PCI DSS certification
PCI certification ensures the security of card data at your business through a set of requirements established by the PCI SSC. These include a number of commonly known best practices, such as:
- Installation of firewalls
- Encryption of data transmissions
- Use of anti-virus software
Source: https://www.imperva.com/learn/data-security/pci-dss-certification/
You can learn more about the PCI DSS at https://www.pcisecuritystandards.org/