As @gowenfawr notes, DSS is silent on this other than requirement 1.3.4 which explicitly requires this capability:
Do not allow unauthorized outbound traffic from the cardholder data
environment to the Internet.
So your use of a TLS intercept for outbound control and inspection certainly allows you to meet this requirement.
There is however requirement 4.1 to consider if the outbound transmission contains cardholder data - and as your question says "this would also impact requests off to the payment providers." - I'm going to assume it does.
Use strong cryptography and security protocols to safeguard sensitive
cardholder data during transmission over open, public networks,
including the following:
- Only trusted keys and certificates are accepted.
- The protocol in use only supports secure versions or configurations.
- The encryption strength is appropriate for the encryption methodology in use.
There are three things to consider.
- Remember DSS is silent about the encryption of cardholder data over
internal networks -- it is not a requirement, so the connection between a) what ever is
sending ChD out of the environment to the payment processor and b) the
MITM device is not a PCI DSS concern (yes, it's a security concern,
make sure you manage that internal cert properly)
- Requirement 4.1 then applies to the connection between the MITM device and the payment
processor, so you need to make sure that the three bullet points of
the requirement are fulfilled. Is the device checking the
authenticity of certs? Are they expired? Are only secure versions of
TLS allowed? Will it downgrade TLS crypto suites if asked? etc.
- However, DSS is not silent about the encryption of "authentication credentials" over internal networks (requirement 8.2.1), so if there is a chance that such "authentication credentials" will be decrypted and examined by the MITM device, then the certificate management and strength of cryptography between the device and whatever made the transmission would be in scope of meeting a "strong cryptography" test. And here I'm mostly thinking about an admin interface at the payment processor that allowed access to cardholder data. This may also apply if the device is acting as a cloud access security broker (CASB) between in internal CDE and a second CDE located at a cloud provider. (An edge case I know, but you should consider it, and if it doesn't apply document this to show your security assessor it had been thought about).
And finally, because the MITM device both transmits and processes cardholder data, it is definitely in scope of all the PCI DSS requirements and is part of your cardholder data environment.