Annual external and internal penetration testing of your Cardholder Data Environment, segmentation validation under 11.4.5, and a QSA-ready report with CVSS scores and named-tester attestation. Built to PCI DSS v4.0.1 by default.
Requirement 11.4: an internal and an external penetration test every 12 months, correction and retest of exploitable findings, and segmentation testing if you rely on segmentation, all under a documented methodology (11.4.1). Each has distinct deliverables, and most QSAs ask for evidence against all four.
External penetration test of the CDE perimeter, annually. Must include network-layer and application-layer testing. Exploitable vulnerabilities retested after remediation. QSA reviews the report and the tester's qualifications.
Internal penetration test covering threats from inside the network. Includes lateral movement paths to the CDE, privilege escalation, and access control validation. Must be performed by a qualified, independent tester.
Every exploitable vulnerability identified must be retested after remediation to confirm closure. The retest report is what the QSA signs off on, not the original report. We include retest in every engagement.
If you use network segmentation to reduce your CDE scope, you must test that the segmentation holds. At least every 12 months and after changes to segmentation controls (every six months for service providers under 11.4.6). We test CDE-to-out-of-scope and out-of-scope-to-CDE in both directions.
Source: PCI DSS v4.0.1, Requirements 11.3 (vulnerability scanning) and 11.4 (penetration testing), PCI Security Standards Council.
PCI scope is the most consequential decision in the engagement. Too narrow and the QSA flags it. Too wide and the cost is unnecessary. We scope it with your QSA's framework in mind.
PCI DSS assessors need specific artifacts. We format every deliverable to pass QSA review without a follow-up request.
Separate sections for 11.4.3 (external) and 11.4.2 (internal). Each finding includes CVSS 4.0 vector, risk narrative, reproduction steps, and remediation. Methodology section cites PTES and OWASP WSTG.
Dedicated section or standalone report for 11.4.5. Documents what was tested, from what position, and the result of each segmentation test. Traffic captures and denial evidence included.
Each exploitable finding retested after remediation. Marked resolved, partially resolved, or accepted-risk with documented rationale. QSAs accept this as closure evidence without additional review cycles.
Named engineer, relevant certifications, confirmation of organizational independence from the CDE. PCI DSS v4.0.1 requires QSAs to verify tester qualifications. We provide this proactively.
Both. They are separate requirements, and passing one does not satisfy the other.
Quarterly automated external vulnerability scan by an Approved Scanning Vendor. Covers known CVEs against publicly reachable IPs. Passing scan = no high-severity open vulnerabilities against the CDE perimeter. Required separately from the pentest.
Annual manual test by a qualified, independent tester. Goes beyond CVE matching. It includes chaining, business logic, authentication testing, and attack paths ASV tools cannot see. A clean ASV scan does not satisfy 11.4. A clean pentest does not satisfy 11.3.2.
The QSA needs both. Most clients arrive at assessment with one but not the other. We often identify this gap during the scoping call and help coordinate timing with your ASV if needed.
Quarterly internal vulnerability scanning is a third separate requirement. Your internal scanner output is not the same as the internal penetration test under 11.4.2. If you run Tenable or Qualys internally, that covers 11.3.1. Our internal pentest covers 11.4.2.
| Activity | Requirement | Frequency | Performed by |
|---|---|---|---|
| External vulnerability scan | 11.3.2 | Every three months and after significant changes | PCI SSC Approved Scanning Vendor (ASV) |
| Internal vulnerability scan | 11.3.1 | Every three months and after significant changes | Qualified internal or external personnel |
| Internal and external penetration test | 11.4.2, 11.4.3 | Every 12 months and after significant changes | Qualified, organizationally independent tester |
| Segmentation test | 11.4.5 (11.4.6 for service providers) | Every 12 months (every six months for service providers) and after segmentation changes | Qualified, organizationally independent tester |
What comes up on every PCI DSS scoping call. See compliance gap analysis if you need a full PCI readiness review alongside the test.
A documented testing methodology (11.4.1), annual internal penetration test (11.4.2), annual external penetration test (11.4.3), correction and retesting of exploitable vulnerabilities (11.4.4), and segmentation testing if you use network controls to reduce CDE scope (11.4.5, every six months for service providers under 11.4.6). All of them apply to most cardholder environments.
No. ASV scans satisfy Requirement 11.3.2 (quarterly external scanning). Penetration testing satisfies Requirement 11.4 (annual manual testing). They are separate requirements. A clean ASV scan does not replace the pentest.
PCI DSS v4.0.1 requires organizational independence from the tested environment. External testers satisfy this automatically. The QSA will ask for the tester's name, credentials, and confirmation that they had no involvement in managing the CDE. We provide all three in the engagement deliverables.
Within 12 months prior to the assessment. If your assessment is in Q4, run the pentest in Q1–Q2 to leave time for remediation and retest. QSAs will ask for the retest report, not just the original findings report.
Even a segmented, minimal CDE requires the annual pentest under 11.4.2 and 11.4.3. The segmentation test under 11.4.5 becomes more important, not less, because your scope reduction argument depends entirely on that segmentation holding.
Both. SAQ-D merchants with a full CDE need the complete Requirement 11.4 engagement. SAQ-A merchants using fully outsourced card data (iframe-based payment pages) often need a reduced scope test focusing on the payment integration and segmentation from the rest of the environment.
Last reviewed .
Scoping call covers your CDE boundary, segmentation controls, and QSA timeline. 30 minutes. Free. No NDA required for the first call.