Take card payments? Then PCI DSS has a clear rule about penetration testing. Here it is in plain language — no compliance-speak.
Who it’s for
Businesses that accept or process card payments
You’ll learn
- · What PCI DSS 4.0 requires
- · How often to test
- · What segmentation testing means
Reading time
7 min read
PCI DSS 4.0
Global- The requirement
- Requirement 11.4 — internal and external penetration testing, including segmentation.
- Auditors look for
Internal and external penetration test reports
Segmentation test results
Retest evidence for exploitable findings
- How we help
- Internal, external and segmentation testing of your cardholder data environment.
- 1
What Requirement 11.4 asks for
PCI DSS 4.0 requires internal and external penetration testing at least once every 12 months and after any significant infrastructure or application change.
The testing should follow a defined methodology and cover both the network and application layers of the cardholder data environment.
- 2
Segmentation testing
If you use segmentation to reduce PCI scope, those controls must be tested too, to confirm the cardholder data environment is properly isolated. Service providers must test segmentation more frequently.
- 3
Fix and retest
Exploitable vulnerabilities found during testing must be corrected and the testing repeated to verify the fixes. Keep both reports for your assessor.
- 4
What counts as a significant change
New systems in the cardholder data environment, major application releases, network changes and new connections to third parties are typical examples. When in doubt, discuss with your assessor and plan a targeted test.
- 5
Preparing for your assessor
Keep the methodology, the report, evidence of fixes and the retest results together. Assessors also look for testers who are qualified and organizationally independent from the systems they test.
How our team helps
- 01Test internal and external layers of your CDE
- 02Validate segmentation controls
- 03Follow a documented, industry-accepted methodology
- 04Retest fixes and provide evidence for your assessor
- 05Help define your cardholder data environment for testing
- 06Document our methodology for your assessor
- 07Plan targeted tests after significant changes
From our work · technical details
How we handle this in Network VAPT
- Outdated, unpatched services
- SMB signing disabled (NTLM relay)
- Default credentials on network devices
- Overly permissive firewall rules
- Weak Active Directory password policies
- Missing network segmentation
We test cardholder environments with your assessor’s expectations in mind.
— The CRIS InfoTech security team