PCI DSS Penetration Testing Requirements: Scope, Frequency, Methodology & Reporting

PCI DSS Requirement 11.4 mandates that organizations conduct both internal and external penetration testing to identify and address security vulnerabilities in their cardholder data environment. Penetration testing goes beyond automated vulnerability scanning by simulating real-world attacks to validate whether identified vulnerabilities can actually be exploited. This guide covers the complete penetration testing requirements under PCI DSS 4.0, including scope, methodology, frequency, and how testing results must be documented and remediated.

PCI DSS Penetration Testing vs Vulnerability Scanning

• Vulnerability scanning is automated and identifies known vulnerabilities; penetration testing is manual and exploits them
• ASV scans are required quarterly for external systems; internal scans also quarterly
• Penetration testing validates whether vulnerabilities can actually be exploited in context
• Both scanning and penetration testing are required; neither substitutes for the other
• Scanning provides breadth of coverage while penetration testing provides depth of validation

Scope of PCI DSS Penetration Testing

• Testing must cover the entire CDE perimeter and all critical systems
• Segmentation controls must be separately tested to validate scope reduction
• Both external (internet-facing) and internal (inside-network) testing are required
• Application-layer boundaries between CDE and out-of-scope networks must be tested
• Internal testing simulates compromised insiders, malware, and post-exploitation scenarios

Frequency and Timing of Penetration Tests

• Penetration testing is required at least every 12 months and after significant changes
• Significant changes include new systems, network topology changes, and encryption modifications
• Targeted risk analysis under PCI DSS 4.0 may indicate more frequent testing is needed
• Tests should be timed to ensure current results at the time of PCI DSS assessment
• Remediation and retesting of findings should be completed before the assessment

Methodology and Standards

• Testing must follow an industry-accepted methodology such as NIST SP 800-115 or PTES
• Both network-layer and application-layer testing are required
• Application testing must cover OWASP Top 10 and payment-relevant vulnerabilities
• Testing must include exploitation attempts, not just vulnerability identification
• Post-exploitation activities including privilege escalation and lateral movement are required

Who Can Perform PCI DSS Penetration Testing

• Internal resources or external firms can perform testing, but must be qualified and independent
• Internal testers must be organizationally independent from the environment being tested
• Recognized certifications (OSCP, GPEN, CEH, CREST) demonstrate competence to assessors
• External firms provide easier independence demonstration and diverse testing experience
• Tester qualifications must be documented and available for assessor review

Remediation and Retesting Requirements

• Exploitable vulnerabilities must be remediated and verified through retesting
• Critical findings allowing CDE access should be addressed within days
• Retesting must confirm the specific exploit no longer succeeds, not just that a patch was applied
• Complete documentation of findings, remediation, and retest results is required
• Risk-based remediation timelines should be established and followed consistently

Related Resources

Other Compliance Guides