What it asks for. Requirement 1 of PCI DSS v4.0 covers network security controls such as firewalls and other technologies that control traffic between networks. It includes defined processes and roles, configuration standards, restricting traffic into and out of the cardholder data environment, controlling connections between trusted and untrusted networks and protecting devices that connect to both.
In practice. Organisations keep accurate network and data flow diagrams, document a business justification for every permitted service, protocol and port, and review rule sets at least every six months. Traffic to and from the cardholder data environment is limited to what is necessary. Evidence includes diagrams, configuration standards, rule review records and controls on laptops and other devices that connect to untrusted networks.
Common gaps. Diagrams are often out of date. Rule sets accumulate broad or unjustified rules, and cloud security groups may be managed outside the documented process.