11.2.1 Detect authorized and rogue wireless access points

The entity manages wireless access points, authorized or not, by: testing for the presence of Wi-Fi access points; detecting and identifying every authorized and unauthorized access point; performing this testing, detection and identification at least every three months; and, where automated monitoring is in place, notifying personnel through generated alerts. Guidance (examples and good practice): methods may include wireless scans, physical or logical inspection, network access control or wireless IDS/IPS, combined as the environment's size and complexity dictate. Applicability: the requirement still applies where policy bans wireless technology, and the chosen methods must be able to find both authorized and unauthorized devices, including rogue devices plugged into equipment that is itself authorized. Objective under the customized approach: rogue wireless access points are found and dealt with on a periodic basis.

Source: PCI DSS v4.0.1, 11.2.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.