Every service, protocol and port that is permitted must be identified, approved, and supported by a defined business need. The guidance explains the purpose: once the needed items are known, everything else can be disabled or removed rather than left open and unpatched, and it recommends that approvals come from people independent of those managing the configuration. Applicability: no special notes; applies to every assessed entity. Customized approach objective: network traffic that is not authorised, whether services, protocols or packets bound for particular ports, cannot pass into or out of the network.
This control maps to 65 controls across 22 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of PCI DSS 4.0 have you already done?
PCI DSS 4.0 1.2.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.