To verify compliance with 1.1.1, what activity should be performed on a sample of network connections?

To verify compliance with 1.1.1, what activity should be performed on a sample of network connections?

• A. Run a full security audit annually.
• B. Review only the firewall configuration settings.
• C. Examine records relating to network connections to verify approvals and testing for a sample of connections, and interview responsible personnel.
• D. Check vendor certifications.

Answer: (C)

Verifying 1.1.1 is about confirming that each network connection to the cardholder data environment has formal approval and has been tested. The strongest evidence comes from examining the records that show approvals and testing for a sample of connections, and by interviewing the people responsible for managing those connections. This demonstrates that there are documented processes and that they are actually followed, not just that configurations exist or that vendors hold certifications. Why the other approaches fit less well: a full security audit annually is too broad and not focused on the specific evidence of approvals and testing for individual connections; reviewing only firewall configuration settings misses the critical elements of authorization and validation testing; vendor certifications do not prove that internal connections were properly approved or tested.

Verifying 1.1.1 is about confirming that each network connection to the cardholder data environment has formal approval and has been tested. The strongest evidence comes from examining the records that show approvals and testing for a sample of connections, and by interviewing the people responsible for managing those connections. This demonstrates that there are documented processes and that they are actually followed, not just that configurations exist or that vendors hold certifications.

Why the other approaches fit less well: a full security audit annually is too broad and not focused on the specific evidence of approvals and testing for individual connections; reviewing only firewall configuration settings misses the critical elements of authorization and validation testing; vendor certifications do not prove that internal connections were properly approved or tested.