1.1.1 Requirement 1 policies and procedures governed
Every security policy and operational procedure called for under Requirement 1 (network security controls) must meet four conditions: it is written down, it is kept current, it is actually followed in practice, and every party it affects is aware of it. This covers the whole set of Requirement 1 documents, such as ruleset standards, change handling for network connections, diagram upkeep and device controls. Applicability: no special notes; it applies to every assessed entity. Customized approach objective: personnel involved in Requirement 1 activities understand and follow defined expectations, controls and oversight, and the supporting work is repeatable, consistent and aligned with what management intends.
Source: PCI DSS v4.0.1, 1.1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Distribution or acknowledgement records showing network and firewall staff received the current versions · HR system / LMS
- Interview notes from network administrators describing how they apply the procedures day to day · Cloud console / configuration management
governing documentDocuments that govern the control
- Network security policy and the operational procedures that implement Requirement 1, with version history and last review date · Policy repository / GRC workspace
- Document control register showing owners and revision dates for Requirement 1 documents · Policy repository / GRC workspace
First move
Common gaps auditors find
- Procedures describe a retired firewall platform and were not revised after a migration to cloud security groups
- Documents exist but network engineers are unaware of them or follow undocumented tribal practice
- Updates happen only on an annual cycle, not after significant network changes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet