External perimeter
All internet-facing components of the cardholder data environment, at the network and application layers, per 11.4.3.
PCI DSS penetration testing
PCI DSS is the one framework that spells out exactly what a penetration test must include. Requirement 11.4 is prescriptive about methodology, coverage, frequency and segmentation — so this engagement is built directly against it.
What requirement 11.4 demands
Under PCI DSS v4.0, requirement 11.4.1 requires a defined and documented penetration testing methodology. 11.4.2 requires internal testing and 11.4.3 external testing, both at least annually and after any significant change. 11.4.4 requires that exploitable vulnerabilities be corrected and the testing repeated to verify the correction.
11.4.5 is the one that catches organisations out. If you use segmentation to reduce the scope of your cardholder data environment, you must test that the segmentation actually works — at least every six months for service providers, and annually for merchants. A QSA will ask for that evidence specifically, and a general network test does not substitute for it.
Because 11.4.4 requires retesting to verify correction, the free retest included in every engagement is not a nice extra here — it is part of what the requirement asks for.
What you receive for your QSA
- Documented methodology satisfying requirement 11.4.1
- External testing evidence for 11.4.3
- Internal testing evidence for 11.4.2
- Segmentation validation evidence for 11.4.5, reported separately
- Verification retest of corrected findings, satisfying 11.4.4
- Signed attestation letter with scope, dates, methodology and outcome
- Findings referenced to the applicable PCI DSS requirement
- Direct support for QSA questions at no additional charge
Coverage
What gets tested
Internal network
Testing from inside the network toward the CDE, covering the paths an attacker would take after an initial foothold, per 11.4.2.
Segmentation validation
Confirming that out-of-scope networks genuinely cannot reach the CDE, tested and reported as its own deliverable, per 11.4.5.
Application layer
Payment and cardholder-facing applications tested authenticated across roles, including the flows that touch or transmit card data.
FAQ
Questions about this service
How often is testing required?
Annually and after any significant change, for both internal and external testing. Segmentation testing under 11.4.5 is every six months for service providers and annually for merchants.
What counts as a significant change?
There is no universal list — your QSA decides. In practice it includes new infrastructure in the CDE, network topology changes, application upgrades that alter data flows, and moving components between environments. Ask your QSA and we will scope to their answer.
Do you perform ASV scanning as well?
No. ASV scanning under requirement 11.3.2 must be performed by a PCI-approved scanning vendor, which is a separate accreditation. Penetration testing under 11.4 has no such requirement, and the two are distinct deliverables.
Can segmentation testing be done on its own?
Yes. Service providers frequently need a six-monthly segmentation test between full annual penetration tests, and we scope that as a standalone engagement.
Next step
Satisfy requirement 11.4 without a second attempt.
Tell us what you have built. You get a reply within one business day, an NDA, and a free 30-minute scoping call with the person who will do the testing.