Home / Compliance / PCI DSS
PCI DSS penetration testing (Requirement 11.4)
PCI DSS v4.0.1 requires internal and external penetration testing at least once every 12 months and after any significant change, carried out by a qualified, independent tester. Our year-round testing covers both the annual test and the tests after change, led by OSCP-certified testers from a CREST accredited company.
What does Requirement 11.4 ask for?
A summary for guidance only. Always confirm scope with your QSA.
| Requirement | What it means | How we cover it |
|---|---|---|
| 11.4.1 | A documented, industry-accepted method covering the network and application layers, the cardholder data environment perimeter and critical systems | Our written methodology, shared with you and your assessor |
| 11.4.2 | Internal penetration testing at least every 12 months and after significant change | A baseline internal test, then testing after each agreed change |
| 11.4.3 | External penetration testing at least every 12 months and after significant change | A baseline external test, then testing of new internet-facing systems |
| 11.4.4 | Exploitable vulnerabilities are fixed and the fix is retested | Unlimited retests, recorded in the report |
| 11.4.5 | If you use segmentation to reduce scope, test it at least every 12 months and after changes to it | Segmentation testing in the baseline and after firewall changes |
| 11.4.6 | Service providers test segmentation at least every six months | Six-monthly segmentation testing for service providers |
Sources: PCI Security Standards Council document library, Praetorian.
Does an automated pen test meet Requirement 11.4?
On its own, generally no. PCI DSS treats vulnerability scanning (Requirement 11.3) and penetration testing (Requirement 11.4) as separate requirements, and the tester must be qualified and organisationally independent. A certified tester leads every test, exploits and validates every finding, and a Team Lead signs the report your assessor reads. AI-assisted tooling is optional and never replaces that sign-off.
What is a significant change under PCI DSS?
Typical examples include new systems in or connected to the cardholder data environment, infrastructure or operating system upgrades, new or changed payment applications, and changes to firewall rules or segmentation. We agree the list with you before testing starts, so you know what triggers a test.
PCI penetration testing questions.
How often does PCI DSS require penetration testing?
At least once every 12 months and after any significant change, for both internal and external testing. Service providers that use segmentation must test it every six months.
Does the tester need to be a QSA or ASV?
No. PCI DSS asks for a qualified internal resource or a qualified external third party who is organisationally independent of the systems being tested.
What do we give our QSA?
The signed penetration test report, our methodology, evidence of retests for exploitable findings, and segmentation test results where they apply.
Can you test our payment web application?
Yes. Requirement 11.4.1 includes the application layer, and every web app is included in a year-round plan.
Cover the annual test and every change after it.
One retainer for the whole year, with testing after every change.