PCI Firewall Requirements: PCI DSS Requirement 1 and Network Security Controls

Yes, you need a firewall for PCI compliance, or more precisely, network security controls (NSCs). A PCI firewall is any network security control that separates the cardholder data environment (CDE) from other networks and filters the traffic in and out of it: a hardware or virtual firewall, a cloud security group or an equivalent control. PCI DSS v4.0.1 Requirement 1 says these controls must allow only justified traffic, deny everything else and be reviewed at least every six months.

This guide explains what Requirement 1 asks for, how to build a rule base that stands up to assessment, how cloud controls fit in, and the evidence a Qualified Security Assessor (QSA) will want to see.

Key takeaways

• Requirement 1 covers any technology that controls traffic between networks, not just hardware firewalls.
• Every allowed service, protocol and port needs a documented business justification.
• Rule sets must be reviewed at least every six months.
• Inbound and outbound CDE traffic must be restricted to what is necessary.
• Cloud security groups are held to the same standard as physical firewalls.

Do you need a firewall for PCI compliance?

You need controls that do a firewall’s job. Earlier versions of PCI DSS talked about “firewalls and routers”. Version 4.0 replaced this with network security controls, because traffic is now filtered by many kinds of technology:

• Hardware and virtual firewalls
• Cloud security groups and network access control lists
• Cloud-native firewall services
• Kubernetes network policies and service mesh controls
• Host-based firewalls, where they enforce segmentation

Whichever you use, it must separate your CDE from other networks. If you have no segmentation at all, your whole network is in scope, which makes every other requirement harder. Our guide to PCI network segmentation covers architecture options, and our free PCI compliance check shows which SAQ your current set-up points to.

What does PCI DSS Requirement 1 require?

The full text and testing procedures are in PCI DSS v4.0.1 in the PCI SSC document library. For how Requirement 1 fits with the other eleven, see our guide to the 12 PCI DSS requirements.

What PCI firewall rules does the CDE need?

A rule base that passes assessment tends to share the same features:

• Default deny. The final rule on every interface denies everything not explicitly allowed.
• Specific rules. Each rule names specific sources, destinations and ports. “Any” in a CDE rule will be questioned, and usually needs to go.
• Documented rules. Each rule links to a business justification, an owner and the change ticket that approved it.
• Egress filtering. Outbound rules are as tight as inbound ones. Many breaches rely on a compromised system reaching the internet freely.
• Secure management. Administration uses encrypted protocols, comes only from management networks and requires multi-factor authentication.
• No insecure protocols. Replace Telnet, FTP and unencrypted HTTP. Where one cannot be avoided, document the extra controls under 1.2.6.
• Logging. NSCs log allowed and denied traffic to a central system with synchronised time, supporting Requirement 10.

How often must firewall rules be reviewed for PCI DSS?

At least every six months, under Requirement 1.2.7. The review should be a real check, not a signature on last year’s spreadsheet:

1. Export the current rule set from every NSC in scope, including cloud security groups.
2. Compare it with the approved rule documentation and investigate differences.
3. Check each rule is still needed, using hit counts and asking the recorded owner.
4. Tighten rules that are broader than necessary.
5. Remove unused, duplicate and shadowed rules through change control.
6. Record who reviewed, what was found and what changed.

An independent firewall security audit is a good way to get a fresh view, particularly before an assessment.

PCI firewall rule review checklist

Use this list for each six-monthly review, and keep the evidence in the right-hand column so a QSA can see the review happened and what it changed.

Can cloud security groups meet Requirement 1?

Yes. The requirements are the same wherever the CDE sits, but the risks differ.

On premises, firewalls are usually managed by a small team through a central console. The risks are rule creep, forgotten temporary rules and devices that miss firmware updates.

In the cloud, controls are spread across security groups, network ACLs, cloud firewalls and sometimes several accounts or subscriptions. The risks are developers creating permissive rules, drift between environments and resources created outside change control. Managing rules as infrastructure as code, with peer review and automated checks, makes them easier to control and evidence. Under the shared responsibility model your provider secures its infrastructure, but the rules you configure are yours. Cloud penetration testing checks whether those rules hold up.

Is a web application firewall required for PCI DSS?

For public-facing web applications, effectively yes. Since 31 March 2025, Requirement 6.4.2 requires an automated technical solution that continually detects and prevents web-based attacks. A web application firewall, configured to block and kept up to date, is the usual answer. It sits alongside your network firewalls; it does not replace them.

Which other PCI DSS requirements affect firewalls?

• Requirement 2: changing vendor defaults and hardening the NSCs themselves.
• Requirement 6.3.3: installing critical security patches within one month of release, including on firewalls.
• Requirement 8: unique accounts and MFA for NSC administrators.
• Requirement 10: logging, log review and time synchronisation.
• Requirement 11.4: penetration testing of the CDE perimeter, plus segmentation testing at least every 12 months for merchants and every six months for service providers. Our PCI DSS penetration testing covers both, alongside infrastructure penetration testing of the wider network.

What are the most common firewall findings?

• Rules with no documented business justification
• “Any” rules in or out of the CDE
• Temporary rules that were never removed
• Network diagrams that do not match the actual configuration
• Cloud security groups left out of the six-monthly review
• Reviews recorded with no evidence of what was checked
• Unrestricted outbound internet access from the CDE

How Sovereign Secure can help

Well-managed network security controls make the rest of a PCI DSS assessment much easier, because they define and protect your scope. Sovereign Secure is a PCI SSC-approved QSA company. We review NSC configurations as part of every PCI compliance audit, and our PCI compliance checklist lists the Requirement 1 evidence to prepare in advance.