Which PCI DSS requirement includes a sub-requirement that specifies a formal process for approving and testing all network connections and changes to the firewall and router configurations?

Which PCI DSS requirement includes a sub-requirement that specifies a formal process for approving and testing all network connections and changes to the firewall and router configurations?

• A. 1.1.2
• B. 1.1.3
• C. 1.2
• D. 1.1.1

Answer: (D)

Managing changes to network security controls requires a formal process. PCI DSS includes a sub-requirement that specifically calls for an approved and tested workflow for all network connections and any changes to firewall and router configurations. This ensures that every modification to access controls is reviewed for risk, implemented in a controlled manner, tested to verify it does not introduce new vulnerabilities, and documented for accountability. Without this formal change-management step, even well-intentioned changes could create gaps that put cardholder data at risk. That formal change-management requirement sits under the firewall-related controls in the PCI DSS network-security area, reinforcing that the firewall and router configurations must be maintained through disciplined processes. The other parts of the firewall requirements focus on the existence and scope of protections themselves rather than the process of approving and testing changes to those protections.

Managing changes to network security controls requires a formal process. PCI DSS includes a sub-requirement that specifically calls for an approved and tested workflow for all network connections and any changes to firewall and router configurations. This ensures that every modification to access controls is reviewed for risk, implemented in a controlled manner, tested to verify it does not introduce new vulnerabilities, and documented for accountability. Without this formal change-management step, even well-intentioned changes could create gaps that put cardholder data at risk.

That formal change-management requirement sits under the firewall-related controls in the PCI DSS network-security area, reinforcing that the firewall and router configurations must be maintained through disciplined processes. The other parts of the firewall requirements focus on the existence and scope of protections themselves rather than the process of approving and testing changes to those protections.