Which PCI DSS requirement specifically requires installing and maintaining a firewall configuration to protect cardholder data?

Which PCI DSS requirement specifically requires installing and maintaining a firewall configuration to protect cardholder data?

• A. Install and maintain a firewall configuration to protect cardholder data
• B. Do not use vendor-supplied defaults for system passwords and other security parameters
• C. Encrypt transmission of cardholder data across open, public networks
• D. Restrict access to cardholder data by business need to know

Answer: (A)

Firewalls act as the frontline boundary control that keeps cardholder data protected by filtering traffic between trusted and untrusted networks. The requirement to install and maintain a firewall configuration explicitly states that this boundary protection must be in place and continuously managed, not only at setup but also through ongoing maintenance—reviewing and updating rules as the environment changes. By enforcing what traffic is allowed to reach the cardholder data environment, it helps keep sensitive data inside a controlled perimeter and reduces exposure to external threats. The other options address important security practices—hardening systems by not using vendor defaults, protecting data in transit with encryption, and enforcing least-privilege access—but they do not specify the firewall boundary control itself.

Firewalls act as the frontline boundary control that keeps cardholder data protected by filtering traffic between trusted and untrusted networks. The requirement to install and maintain a firewall configuration explicitly states that this boundary protection must be in place and continuously managed, not only at setup but also through ongoing maintenance—reviewing and updating rules as the environment changes. By enforcing what traffic is allowed to reach the cardholder data environment, it helps keep sensitive data inside a controlled perimeter and reduces exposure to external threats. The other options address important security practices—hardening systems by not using vendor defaults, protecting data in transit with encryption, and enforcing least-privilege access—but they do not specify the firewall boundary control itself.