Requirement 1 covers network security controls (firewalls and equivalents) that restrict traffic into, out of and around the cardholder data environment. Each page covers one second-level requirement.
What Requirement 1.1 asks for: documented, current policies and procedures for network security controls and clearly assigned roles for running them, the governance layer that every other Requirement 1 control depends on.
Requirement 1.2 covers how network security controls are configured and kept in order: ruleset standards, change control, network and data-flow diagrams, approved services and ports, six-monthly ruleset reviews and protected configuration files.
Requirement 1.3 restricts network traffic into and out of the cardholder data environment to only what is necessary, with everything else denied, and requires network security controls between every wireless network and the CDE.
Requirement 1.4 controls connections between trusted and untrusted networks: NSCs at the boundary, limited inbound traffic, anti-spoofing, no direct internet access to systems storing cardholder data, and limited disclosure of internal IP and routing information.
Requirement 1.5 addresses laptops and other computing devices, company or employee owned, that connect both to untrusted networks such as the internet and to the CDE, requiring enforced security settings users cannot switch off.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.