#Requirement-by-requirement
| Requirement | What it asks | Evidence an assessor expects |
|---|---|---|
| 11.4.1 | A defined, documented penetration testing methodology: industry-accepted approach, whole CDE perimeter and critical systems, inside and outside the network, segmentation and application-layer testing, threats and vulnerabilities from the last 12 months | Methodology document; how findings are retained |
| 11.4.2 | Internal penetration testing at least every 12 months and after significant changes, by a qualified internal resource or third party with organizational independence | Report, tester qualifications, independence |
| 11.4.3 | External penetration testing on the same frequency and independence conditions | Report covering all external CDE exposure |
| 11.4.4 | Exploitable vulnerabilities and security weaknesses are corrected and testing is repeated to verify the corrections | Retest evidence per finding |
| 11.4.5 | If segmentation is used, segmentation controls are tested at least every 12 months and after changes | Tests from every out-of-scope segment |
| 11.4.6 | Service providers: segmentation tested at least every six months and after changes [1] | Semi-annual segmentation reports |
| 11.4.7 | Multi-tenant service providers support customers' external penetration testing | Process for customer testing |
#Where audits go wrong
- "Significant change" is undefined. Write it down: new internet-facing service, IdP change, network path into the CDE. Then test after every one. With weekly releases, this alone makes continuous testing the practical option.
- No retest. 11.4.4 requires verifying corrections. A ticket marked done is not a retest.
- Segmentation tests run from one segment. They need to originate from each out-of-scope network and prove no path reaches the CDE.
- Scanner output presented as a pentest. Methodology must include exploitation attempts and application-layer testing.
#Scoping 11.4 correctly
Scope follows the cardholder data environment and everything that can affect it. In practice that means the CDE itself, systems connected to it, the network paths between segments, the applications that process or transmit card data, and the external perimeter that exposes any of them. A segmentation test must attempt to reach the CDE from each segment you claim is out of scope; a single successful path brings that segment back into scope for the whole assessment.
Keep the methodology document current. It should say how you choose techniques, how application-layer testing is done, how you handle findings and retests, and how threats and vulnerabilities from the previous 12 months inform the test. Assessors read it before they read the report.
#Using continuous testing for 11.4
Continuous autonomous testing exceeds the frequency requirements by construction and produces per-finding retest evidence for 11.4.4. The points to settle with your QSA are methodology documentation (11.4.1) and tester independence and qualification (11.4.2–11.4.3); many organizations have a qualified human attest the annual report generated from continuous results.
#Sources
Talk to an operator.
Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.
Book a briefing