What does Req 1.1 require to establish and implement?

• A. A formal process for approving & testing all network connections & changes to firewall & router configs.
• B. A disaster recovery plan.
• C. A vulnerability scanning schedule.
• D. A data retention policy.

Answer: (A)

Establishing a formal change-management process for network connections and firewall/router configurations is what this requirement focuses on. The idea is to have a defined, auditable workflow where every change to network connectivity or security devices is reviewed, approved by the right people, and tested in a controlled environment before it goes into production. This helps prevent unapproved or poorly tested changes from creating new security gaps, misconfigurations, or opportunities for data exposure. By documenting approvals, testing results, and the implementation steps, you maintain accountability and traceability for all network-related alterations, which is essential for maintaining a secure cardholder data environment.

Disaster recovery planning, vulnerability scanning schedules, and data retention policies address different areas of security and governance. A disaster recovery plan focuses on restoring operations after disruption, vulnerability scanning schedules target identifying weaknesses, and data retention policies govern how long data is kept. None of these ensure the formal approval and testing process for network and security device changes that this requirement mandates.