How is an untrusted network defined in this context?

How is an untrusted network defined in this context?

• A. A network inside the corporate firewall.
• B. A partner network with agreed access.
• C. Any network external to the entity's networks or outside the entity's ability to control or manage.
• D. A trusted network category.

Answer: (C)

Untrusted networks are those that sit outside the organization’s security boundary and are not under the organization’s control or management. In PCI terms, anything outside the entity’s networks or outside its ability to enforce security controls is considered untrusted. That’s why the broad definition “any network external to the entity’s networks or outside the entity’s ability to control or manage” best captures the idea: it includes the Internet, public networks, and third-party or partner networks when the organization can’t directly manage or secure them. Inside the corporate firewall is a trusted network, so it isn’t untrusted. A partner network with agreed access can still be outside your direct control, but the key point is the lack of control, which the broad definition explicitly covers. A label like “trusted network” doesn’t define untrusted networks at all.

Untrusted networks are those that sit outside the organization’s security boundary and are not under the organization’s control or management. In PCI terms, anything outside the entity’s networks or outside its ability to enforce security controls is considered untrusted. That’s why the broad definition “any network external to the entity’s networks or outside the entity’s ability to control or manage” best captures the idea: it includes the Internet, public networks, and third-party or partner networks when the organization can’t directly manage or secure them.

Inside the corporate firewall is a trusted network, so it isn’t untrusted. A partner network with agreed access can still be outside your direct control, but the key point is the lack of control, which the broad definition explicitly covers. A label like “trusted network” doesn’t define untrusted networks at all.