Penetration testing
Periodic internal and external tests of the cardholder data environment.
home / compliance
compliance · PCI DSS
PCI DSS penetration testing: requirement 11.4
Requirement 11.4 asks for periodic penetration testing of the cardholder data environment, with segmentation verified and fixes confirmed.
what the standard asks
What the requirement asks.
Segmentation
Verification that segmentation isolates the cardholder data environment.
what we produce
The evidence we deliver.
External and internal tests
Both scopes, with method and dates.
Segmentation verification
Proof that networks do not reach each other when they should not.
Confirmation
Repeat of the test after fixes.
Report for the QSA
Structure and content suited to the QSA's assessment.
summary
At a glance.
| Item | Detail |
|---|---|
| Who judges | The QSA |
| Related services | OWASP Top 10 testing and infrastructure testing |
| Typical frequency | Yearly and after significant changes |
Limits. We are not a QSA. The QSA assesses; we produce the evidence.
Want evidence for requirement 11.4?
We reply by hand with a written proposal.