Free guide · PCI DSS v4.0.1

PCI DSS Requirement 1.3.1 — Restricting inbound traffic to the CDE

Requirement 1.3.1 says inbound traffic to the cardholder data environment must be limited to traffic that is necessary, with all other traffic specifically denied. In practice it is the deny-by-default rule that every network security control ruleset protecting the CDE has to end with.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

Any entity with a network-connected cardholder data environment

Merchants and service providers completing SAQ C, SAQ D-Merchant or SAQ D for Service Providers

What Requirement 1.3.1 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

Inbound traffic to the CDE is restricted to only the traffic that is necessary.

All other inbound traffic is specifically denied.

The business justification for each permitted inbound flow is documented and kept current.

Network security control rulesets are reviewed on the cycle defined in Requirement 1.2.

Evidence an assessor expects

Current firewall or security-group rulesets covering every CDE ingress point

A documented business justification for each allowed inbound service, port and protocol

Evidence of the explicit deny rule at the end of each ruleset

Records of the periodic ruleset review and approvals

Common mistakes

Relying on an implicit default deny that the platform does not actually apply, or that a broader rule above it overrides.

Any/any management rules left in place after a migration or an incident.

Cloud security groups left out of scope because the review only covers the on-premises firewalls.

Not sure whether Requirement 1.3.1 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.