Jump to a page or a control
Protect · Foundational tier · Network Security
Network rules keep the cardholder environment and the SWIFT zone apart from the corporate network, and every exception is approved and time-bound.
Status
Gap1 item contradicts the control.
Exposure
Critical
3 evidence items from 1 sources
CCSA · Protect
Below FoundationalThis control blocks Foundational for the whole domain.
A temporary payments-migration rule lets any corporate source reach the cardholder database tier on port 1521.
Remediation · Network Security
Remove TEMP-MIGRATION-CDE-DB, or narrow it to the 2 migration hosts with a 7-day expiry.
Root cause: Payments migration. A temporary firewall rule and unrecorded changes were left behind.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-pr06-1
Permissive corporate-to-CDE rule committed 9 days ago, with no expiry
Palo Alto Networks Panorama · config · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h
Powered by Mesh APIshow config running xpath device-group/entry[@name='CDE-EDGE']/pre-rulebase5b3b556b19891e7d90f49d58f3d1a213bbf2adc9f92a3549c314580b4f066af6ev-pr06-2
The rule has carried traffic from 61 corporate sources
Palo Alto Networks Panorama · telemetry · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h
show rule-hit-count device-group CDE-EDGE rule TEMP-MIGRATION-CDE-DBbe7fab0be173d421a9e8dcd6d47cb8bff20f808e526937c53269775c374e1826ev-pr06-3
SWIFT zone isolated; no rule changes in 97 days
Palo Alto Networks Panorama · config · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 48 h
show config running xpath device-group/entry[@name='SWIFT-ZONE']b7da52776fbe78f7e8c1dbaa3714233a90cc29d58e229d9064d77bfcfdbae841