Which sub-requirement enumerates the need for a formal process for approving and testing network connections and changes to firewall configurations?

Which sub-requirement enumerates the need for a formal process for approving and testing network connections and changes to firewall configurations?

• A. 1.1.2
• B. 1.1.1
• C. 1.2
• D. 1.1.3

Answer: (B)

Managing changes to firewall configurations is about applying a controlled process so that every network connection or firewall modification is formally approved and tested before it goes into production. This prevents unapproved or risky changes from being deployed and helps keep the network boundary protecting cardholder data intact. The sub-requirement that explicitly calls for this formal approval and testing of network connections and firewall changes is the one describing a formal change-management process prior to implementation. The other items cover related firewall duties, like installing or maintaining firewalls or preventing direct public access, but they do not specify the mandatory formal change-management testing step.

Managing changes to firewall configurations is about applying a controlled process so that every network connection or firewall modification is formally approved and tested before it goes into production. This prevents unapproved or risky changes from being deployed and helps keep the network boundary protecting cardholder data intact. The sub-requirement that explicitly calls for this formal approval and testing of network connections and firewall changes is the one describing a formal change-management process prior to implementation. The other items cover related firewall duties, like installing or maintaining firewalls or preventing direct public access, but they do not specify the mandatory formal change-management testing step.