z/OS Communications Server IP packet filtering (IPSec policies) - VLAN segmentation isolating the Cardholder Data Environment (CDE) LPARs - AT-TLS for all inbound connections to the CDE - z/OS Intrusion Detection Services (IDS) for network anomaly detection