Penetration testing for PCI DSS

What Requirement 11.4 asks for

• A defined penetration testing methodology
• External and internal testing at least every 12 months
• Testing after any significant infrastructure or application change
• Segmentation testing if you rely on it to reduce scope
• Correction of exploitable vulnerabilities and retesting

Does it apply to you?

Many smaller merchants using a fully hosted payment page complete a simpler self-assessment questionnaire that may not include penetration testing. Your acquirer or QSA can confirm which applies.

A note on scope

Our complimentary AI pentest is a focused first look, not a formal compliance assessment. If your auditor, assessor or customer needs a full report against a defined scope, we can quote for a full penetration test.

Related

• Penetration testing for SOC 2
• Penetration testing for ISO 27001
• Cyber Essentials Plus and penetration testing
• Penetration testing for DORA

Common questions