| 💼 1.2.1 Configuration standards for NSC rulesets are defined, implemented, maintained. | | | | |
| 💼 1.2.2 All changes to network connections and to configurations of NSCs are approved and managed in accordance with the change control process defined at Requirement 6.5.1. | | | | |
| 💼 1.2.3 An accurate network diagram(s) is maintained that shows all connections between the CDE and other networks, including any wireless networks. | | | | |
| 💼 1.2.4 An accurate data-flow diagram(s) is maintained. | | | | |
| 💼 1.2.5 All services, protocols, and ports allowed are identified, approved, and have a defined business need. | | | | |
| 💼 1.2.6 Security features are defined and implemented for all services, protocols, and ports that are in use and considered to be insecure, such that the risk is mitigated. | | | | |
| 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective. | | | | |
| 💼 1.2.8 Configuration files for NSCs are secured from unauthorized access and kept consistent with active network configurations. | | | | |