In general, MPLS networks areWhether an MPLS network can be considered "a private " networks and do not require encryption. This, however,network is dependent upon the specific provider and/or configuration . If the IP addresses are public and the MPLS network provides exposure to the Internet either through the LSR or other device (if theof that network. The implementation would need to be evaluated to determine whether the MPLS network provides exposure to the Internet or other untrusted networks, before concluding whether the MPLS network can be considered private. If the MPLS network contains publically-accessible IP addresses or otherwise provides exposure to the Internet (for example, if an edge router has an Internet port), then it should be reviewed carefully as it is likelymay need to be considered an "untrusted" . The QSA should review the implementation and determine whether the IP addresses are public such that the MPLS network provides exposure to the Internet, before concluding thator a public network.
If the MPLS network is determined to be private, transmissions of cardholder data over that network would not need to be encrypted per PCI DSS Requirement 4.1. However, if there are points of exposure to the Internet or it is a shared connection, the MPLS network iscould be considered private. If the QSA cannot gain that assurance, then the whole network should be in scope. The PCI SSC is not compiling a list of approved MPLS solutions nor do they have any plans to do so. This requirement for encrypted transmissions is intended to apply to transmissions outside of an internal network to an external third party, going over an open, public network; this requirement does not apply to transmissions over an internal network protected by external facing firewalls, since that is not considered a public networkas untrusted or public, and Requirement 4.1 would apply.
MPLS networks that have been verified as being private are still in scope for PCI DSS, and, as with all private networks that are in scope, the MPLS network and associated devices would need to meet the applicable PCI DSS requirements.
