Penetration testing for PCI DSS
PCI DSS requirement 11.4 requires internal and external penetration testing at least once every 12 months and after significant changes, using a defined, industry-accepted methodology, plus testing that network segmentation isolates the cardholder data environment. HYDN carries out this testing and reports in a form your assessor can use.
What requirement 11.4 asks for
- A penetration testing methodology defined by the entity, based on industry-accepted approaches, covering the whole cardholder data environment perimeter and critical systems.
- External testing at least once every 12 months and after significant changes.
- Internal testing at least once every 12 months and after significant changes.
- Segmentation testing to confirm that out-of-scope systems cannot reach the cardholder data environment.
- Remediation of exploitable findings, with repeat testing to verify.
- Testing by a qualified person who is organisationally independent of the systems tested.
How HYDN runs it
Our methodology follows PTES, OWASP and NIST. We agree the cardholder data environment boundary with you, test the external perimeter, internal networks, applications and segmentation, then document each finding with severity, proof of concept and remediation. One remediation check is included, and the final report is written for your QSA or internal assessor.
Frequently asked questions
How often does PCI DSS require penetration testing?
Internal and external tests at least once every 12 months and after any significant infrastructure or application change. Segmentation controls must be tested at least every 12 months, and every six months for service providers.
Do findings have to be fixed?
Yes. Exploitable vulnerabilities found by the test must be corrected and the testing repeated to verify the fixes. HYDN includes a remediation check in every engagement.
Published Updated