0

I would like to ask about the first requirement of PCI DSS which is build and maintain a secure network.

Is it required to have a physical firewall or it can be a software example using operating system firewall iptable rules?

Improve this question

2 Answers 2

Reset to default
2

A physical firewall is just a network-connected computer running software, so of course a firewall implemented in software is acceptable. There's no other kind. What it can't do for PCI compliance is to run the firewall software on the same machine as any of the services that it's protecting.

Improve this answer
0

PCI-DSS has the concept of in-scope and out-of-scope systems/processes/data/infrastructure etc.

So if your system respects those principles, you're ok (physical or virtual)

Just a hint : Azure, AWS etc Have a PCI DSS compliance status (even if it does not automatically translate to PCI DSS certification for the services that customers build or host on these platforms.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .