[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-1":3},{"item":4,"lessons":16,"controls":39,"related":67},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-1","Requirement 1","Requirement 1: Install and Maintain Network Security Controls",7,"PCI Security Standards Council","**What it asks for.** Requirement 1 of PCI DSS v4.0 covers network security controls such as firewalls and other technologies that control traffic between networks. It includes defined processes and roles, configuration standards, restricting traffic into and out of the cardholder data environment, controlling connections between trusted and untrusted networks and protecting devices that connect to both.\n\n**In practice.** Organisations keep accurate network and data flow diagrams, document a business justification for every permitted service, protocol and port, and review rule sets at least every six months. Traffic to and from the cardholder data environment is limited to what is necessary. Evidence includes diagrams, configuration standards, rule review records and controls on laptops and other devices that connect to untrusted networks.\n\n**Common gaps.** Diagrams are often out of date. Rule sets accumulate broad or unjustified rules, and cloud security groups may be managed outside the documented process.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},5,[19,23,27,31,35],{"slug":20,"title":21,"published_at":22},"pci-dss-401-elevates-application-security-to-mandatory-compliance-in-20252026","PCI DSS 4.0.1 Elevates Application Security to Mandatory Compliance in 2025–2026","2026-08-27T18:20:21.242+00:00",{"slug":24,"title":25,"published_at":26},"active-exploitation-of-critical-oracle-e-business-suite-flaw-detected-before-public-poc-release","Active Exploitation of Critical Oracle E-Business Suite Flaw Detected Before Public PoC Release","2026-07-01T20:20:54.337+00:00",{"slug":28,"title":29,"published_at":30},"pci-dss-v401-demands-script-control-on-checkout-pages","PCI DSS v4.0.1 Demands Script Control on Checkout Pages","2026-06-18T12:20:34.375+00:00",{"slug":32,"title":33,"published_at":34},"critical-atm-systems-exposed-to-internet-attacks","Critical ATM Systems Exposed to Internet Attacks","2026-06-03T18:06:14.62+00:00",{"slug":36,"title":37,"published_at":38},"atm-and-pos-infrastructure-compromised-for-card-cloning-operation","ATM and POS Infrastructure Compromised for Card Cloning Operation","2026-03-24T20:07:02.55+00:00",[40,45,50,54,58,63],{"slug":41,"name":42,"problem":43,"stories":44},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",4,{"slug":46,"name":47,"problem":48,"stories":49},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",2,{"slug":51,"name":52,"problem":53,"stories":49},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",{"slug":55,"name":56,"problem":57,"stories":49},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":59,"name":60,"problem":61,"stories":62},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":64,"name":65,"problem":66,"stories":62},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[68,73,79,83,87,91,96,100],{"family":69,"item":70,"code":71,"title":72,"together":44},"cis","7","Control 7","Continuous Vulnerability Management",{"family":74,"item":75,"code":76,"title":77,"together":78},"nist-800-53","sc-7","SC-7","Boundary Protection",3,{"family":74,"item":80,"code":81,"title":82,"together":78},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":69,"item":84,"code":85,"title":86,"together":78},"12","Control 12","Network Infrastructure Management",{"family":69,"item":88,"code":89,"title":90,"together":49},"13","Control 13","Network Monitoring and Defense",{"family":92,"item":93,"code":94,"title":95,"together":49},"gdpr","32","Article 32","Security of processing",{"family":69,"item":97,"code":98,"title":99,"together":49},"2","Control 2","Inventory and Control of Software Assets",{"family":74,"item":101,"code":102,"title":103,"together":49},"si-2","SI-2","Flaw Remediation"]