PCI DSS v4.0.1 Penetration Testing (Requirement 11.4)

PCI DSS (Payment Card Industry Data Security Standard) is the card data security standard published by the PCI Security Standards Council (PCI SSC). The current version is v4.0.1, published in June 2024.

It covers every organization that stores, processes or transmits cardholder data, or can affect the security of that environment: merchants, e-commerce sites, payment institutions and service providers. How compliance is validated depends on the card brands and your acquirer or payment provider.

• Methodology (11.4.1): industry-accepted approach; coverage of the entire CDE perimeter and critical systems; testing from inside and outside the network; application- and network-layer testing; retention of results for at least 12 months.
• Internal and external testing (11.4.2, 11.4.3): at least once every 12 months and after any significant infrastructure or application upgrade or change; by a qualified internal resource or qualified external third party; with organizational independence of the tester. The tester is not required to be a QSA or ASV.
• Remediation and retesting (11.4.4): exploitable vulnerabilities are corrected according to risk and the corrections are retested.
• Segmentation testing (11.4.5, 11.4.6): where the CDE is isolated by segmentation, at least every 12 months and after segmentation changes; at least every six months for service providers.
• External vulnerability scanning (11.3.2): at least once every three months by a PCI SSC Approved Scanning Vendor (ASV).

Nokta Guard is not an ASV or a QSA. Quarterly ASV scans require a PCI SSC Approved Scanning Vendor, and compliance assessment is handled by your QSA or payment provider; on the penetration testing side we work in step with those processes.

• Definition of CDE scope and data flows, with a written test methodology aligned to 11.4.1.
• External and internal network penetration testing, plus application-layer testing of payment pages and APIs.
• Segmentation testing that validates the effectiveness of segmentation controls.
• A report mapped to the requirements that assessors can trace, and retesting under 11.4.4.