Category: Network Security

Network Security Controls

Also known as: NSCs, Network Security Control, firewalls (as a common implementation)

Simply put

Network Security Controls (NSCs) are technologies that manage and restrict traffic moving between different parts of a network, allowing intended connections while blocking unwanted ones. Firewalls are the most familiar example, but other network technologies can act as NSCs as well. In payment security, they are used to help protect systems that store, process, or transmit cardholder data by controlling what can reach those systems.

Formal definition

In PCI DSS v4.0, the term 'network security controls (NSCs)' replaced the earlier terminology centered on 'firewalls and routers' to describe network technologies that act as policy enforcement points, controlling network traffic between two or more logical or physical network segments based on defined rules. NSCs are the subject of PCI DSS Requirement 1, which addresses installing and maintaining such controls, including provisions that NSC configurations be defined, maintained, and periodically reviewed; confirm exact requirement numbering and wording against the current published standard, as these differ between versions. Firewalls are a common implementation, but an NSC may be any qualifying network security technology serving as an enforcement point. Note that the broader phrase 'network security control' is used generically across other frameworks (for example, ISO/IEC 27001 Annex A) and is not exclusive to PCI DSS; the NSC term and its specific control expectations described here derive from PCI DSS Requirement 1.

Why it matters

Systems that store, process, or transmit cardholder data are exposed to risk whenever untrusted networks can reach them directly. Network Security Controls (NSCs) are the mechanism PCI DSS relies on to define and enforce which connections are permitted between network segments, helping to limit the paths an attacker could use to reach sensitive systems. Without properly configured NSCs, a compromise in one part of a network can more easily spread toward the systems handling payment data.

The move to NSC terminology in PCI DSS v4.0 reflects the reality that a firewall is no longer the only technology that can act as a policy enforcement point. By describing the control by its function rather than by a single product type, the standard accommodates a range of network security technologies while keeping the underlying objective constant: controlling traffic between logical or physical network segments based on defined rules. This matters for compliance validation, because assessors evaluate whether the enforcement point does what is required, not whether it carries a particular label.

Because NSC configurations tend to accumulate rules over time, they can drift from their intended state, leaving overly permissive access that widens exposure. PCI DSS therefore treats ongoing maintenance and periodic review of NSC configurations as part of the control, not a one-time setup task. Note that exact requirement numbering and review intervals differ between PCI DSS versions and should be confirmed against the current published standard rather than assumed.

Who it's relevant to

Security engineers and network architects

These teams design and implement the enforcement points that segment cardholder data environments from other networks. They select which technologies serve as NSCs, define rulesets, and ensure configurations align with the intended traffic-control policy. Because an NSC is defined by its enforcement function rather than a product name, they have flexibility in the technologies chosen, provided the control meets the applicable expectations.

Compliance officers and QSAs

Those responsible for PCI DSS validation assess whether NSCs are configured and maintained, and whether their configurations are reviewed on the required periodic basis. They should map controls to the current version of Requirement 1 and confirm exact requirement numbering and wording against the published standard, since these differ between versions.

Merchants and payment processors

Organizations that store, process, or transmit cardholder data rely on NSCs — often implemented as firewalls — to restrict what can reach systems handling payment data. They must ensure NSCs remain in place, correctly configured, and reviewed over time rather than treated as a one-time deployment.

Security operations and audit teams

Teams conducting NSC configuration or firewall ruleset reviews examine existing rules to identify outdated, redundant, or overly permissive entries that could widen exposure. These reviews support the ongoing maintenance expectation that distinguishes NSCs from a set-and-forget configuration.

Inside NSCs

Network Security Controls (NSCs)

A category of technologies and rulesets that govern and restrict network traffic between segments, systems, or trust boundaries. In recent PCI DSS versions, the term 'network security controls' was introduced as a broader replacement for the earlier 'firewalls and routers' phrasing, so that it encompasses firewalls, router configurations, and functionally equivalent technologies such as virtual devices, cloud access controls, container network policies, and other tools that enforce network segmentation. The phrase is not exclusive to PCI DSS; it appears generically across security frameworks, and comparable network security controls are described in standards such as ISO/IEC 27001. Confirm the exact definition and requirement wording against the current published PCI DSS, as terminology and numbering differ between versions.

Traditional firewalls

Hardware or software devices that inspect and filter traffic based on defined rules. They are one common implementation of an NSC but not the only one; PCI DSS uses the broader NSC term precisely to avoid limiting the concept to a single device type.

Router and switch configurations

Access control lists and configuration settings that restrict traffic flow between network segments. These may function as NSCs when they enforce the intended traffic restrictions between the cardholder data environment (CDE) and other networks.

Cloud and virtualized controls

Security groups, virtual firewalls, container network policies, and equivalent cloud-native constructs that enforce traffic segmentation in virtualized or cloud environments, serving the same function as physical NSCs.

Rulesets and traffic restriction policies

The documented and enforced rules that determine which traffic is permitted or denied between networks. Effective NSCs depend on maintained, justified, and reviewed rulesets rather than on the device label alone.

Segmentation relationship

NSCs are a common means of implementing network segmentation to reduce PCI DSS scope, but segmentation is a distinct concept; its effect on scope depends on implementation and validation rather than on the presence of an NSC.

Common questions

Answers to the questions practitioners most commonly ask about NSCs.

Is 'Network Security Controls' a term unique to PCI DSS?

No. PCI DSS adopted the phrase Network Security Controls (NSCs) as a broader term than traditional firewalls, but the general concept of network security controls appears across many security frameworks and standards, including ISO/IEC 27001. When you see NSCs referenced, confirm whether the discussion is about the PCI DSS-defined usage or a generic use in another standard, since the specific expectations and validation criteria differ by framework.

Does 'NSC' just mean a hardware firewall by another name?

No. PCI DSS uses NSCs to describe a broader category than a single hardware firewall appliance. The term is intended to cover technologies that enforce policy on network traffic between segments or trust boundaries, which can include physical firewalls, virtual firewalls, cloud security groups, and other controls that perform equivalent functions. The label matters less than whether the control actually enforces the intended traffic policy; confirm the exact wording and requirements against the current published PCI DSS version rather than assuming a fixed requirement number.

How do NSCs relate to network segmentation used to reduce PCI DSS scope?

NSCs are one mechanism commonly used to implement and enforce segmentation between the cardholder data environment (CDE) and out-of-scope systems. Segmentation is not automatically achieved by deploying an NSC; the control must be configured, tested, and validated to demonstrate that in-scope and out-of-scope networks cannot communicate in ways that would bring additional systems into scope. Where segmentation is relied upon to reduce scope, its effectiveness typically needs to be verified through testing. Confirm current testing expectations against the published standard.

What should a ruleset review of NSCs cover?

A ruleset review generally examines whether configured rules still map to a documented business justification, whether overly permissive or unused rules exist, and whether traffic is restricted to what is necessary between trust boundaries. Reviews should also check for consistency between intended policy and the deployed configuration. The specific frequency and documentation expectations are defined in PCI DSS; verify them against the current version, since requirement wording and numbering differ between versions.

How do NSCs apply in cloud and virtualized environments?

In cloud and virtualized environments, NSC functions may be delivered through virtual firewalls, security groups, network access control lists, or provider-managed constructs rather than dedicated physical appliances. These can satisfy the intent of NSC requirements when they enforce the required traffic policy at the relevant trust boundaries, but responsibility may be shared between the customer and the service provider. Clarify the shared-responsibility boundary and confirm which party configures, monitors, and validates each control.

Do NSCs alone protect the cardholder data environment from compromise?

No single control eliminates risk. NSCs help restrict and control network traffic to and from the CDE and may reduce exposure, but they are intended to work alongside other controls such as access management, logging and monitoring, vulnerability management, and protection of stored data. NSCs do not address threats that operate within an allowed path or at the application layer, so they should be treated as one layer of a defense-in-depth approach rather than a standalone safeguard.

Common misconceptions

The term 'Network Security Control' is unique to PCI DSS.

The phrase is used generically across security standards and frameworks, including ISO/IEC 27001, where comparable network security controls are addressed. PCI DSS adopted the term to broaden its earlier 'firewalls and routers' language, but the concept itself is not specific to PCI DSS.

An NSC means a traditional hardware firewall.

PCI DSS uses the broader NSC term intentionally so it covers firewalls, router configurations, and functionally equivalent technologies such as virtual devices, cloud security groups, and container network policies. The control function, not the device type, is what matters.

Deploying an NSC automatically reduces PCI DSS scope through segmentation.

An NSC may support segmentation, but scope reduction depends on how segmentation is implemented and validated, not on the mere presence of a network security control. Segmentation and NSCs are related but distinct concepts.

Best practices

Maintain documented, justified rulesets for each NSC and review them periodically to confirm that permitted traffic remains necessary and appropriate; confirm review expectations against the current published PCI DSS.

Treat functionally equivalent technologies, such as virtual firewalls, cloud security groups, and container network policies, as NSCs and apply consistent configuration and review controls across physical, virtual, and cloud environments.

Verify that NSCs actually enforce the intended segmentation between the cardholder data environment and other networks, and validate segmentation effectiveness rather than assuming the NSC label guarantees isolation.

Apply least-privilege principles to NSC rules, permitting only required traffic and denying by default where feasible.

Confirm the exact NSC definition, requirement wording, and numbering against the current published version of PCI DSS, since terminology has changed between versions.

Where relevant, align NSC practices with comparable network security control guidance in other frameworks such as ISO/IEC 27001 to support consistent governance across standards.