Policy 12 — Network Security Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 12. Values shown as [X] are placeholders still to be set.

Purpose

To protect Revique's network through controlled firewall/security-group rules, segmentation, and elimination of unnecessary exposure.

Scope

Applies to all network components, security groups, and connectivity in all environments.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Firewall/security-group rules must restrict traffic to only what is required, and default to deny.

2No system component must expose unnecessary ports or services to the internet.

3Inbound administrative access (e.g. SSH) from the public internet must not be allowed; secure access methods must be used instead.

4The cardholder data environment must be segmented from untrusted networks.

5Network rules must be reviewed at least every [X] months.

Roles & responsibilities

Role	Responsibility
Security Officer	Approve and review network rules.
DevOps / IT	Implement and maintain firewall/security-group configurations.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→