PCI DSS 11.4 asks you to define a penetration testing methodology, run internal and external tests at least every 12 months and after significant change, fix exploitable findings and retest, and, if you use segmentation, test it. Testers must be qualified and independent but need not be a QSA or ASV. This is not legal advice.
What the methodology must include
The SAQ D text for 11.4.1 lists the elements of your methodology:
- Industry-accepted approaches.
- Coverage of the entire CDE perimeter and critical systems.
- Testing from inside and outside the network.
- Testing that validates segmentation and scope-reduction controls.
- Application-layer testing for at least the vulnerabilities listed in 6.2.4.
- Network-layer testing covering network function components and operating systems.
- Review of threats and vulnerabilities experienced in the last 12 months.
- A documented way to assess and address risk from exploitable findings.
- Retention of results and remediation records for at least 12 months.
Who, when and what next
| Requirement | Rule |
|---|---|
| 11.4.2 internal test | Per your methodology, at least every 12 months, after significant change, qualified tester with independence |
| 11.4.3 external test | Same frequency and independence rules |
| 11.4.4 fixes | Exploitable findings corrected per your 6.3.1 risk assessment, then the test is repeated to verify |
| 11.4.5 segmentation | If segmentation isolates the CDE, test controls at least every 12 months and after changes |
"Internal" means testing from inside the CDE and into it from internal networks. "External" means the exposed perimeter and critical systems connected to public infrastructure.
Common mistakes
- Treating a vulnerability scan as a pen test. They are different requirements. See our comparison.
- Scoping the test to the application only and skipping the network layer.
- Skipping the retest after fixes.
- Letting the person who built the system also test it, which breaks independence.
- Losing the report within a year.
Preparing the test
Give the tester your data flow diagram, scope list and a list of recent changes. Agree rules of engagement, test windows and who to call if something breaks. Plan time after the test to fix and retest, because 11.4.4 expects verification, not just a list of issues.
Quick check
Must a QSA do the penetration test?
No. The SAQ D text says the tester is not required to be a QSA or ASV, but must be qualified with organizational independence.
Do I need to test after every release?
The requirement says after any significant infrastructure or application upgrade or change. What counts as significant is for you and your assessor to define.
On Safeguard: vulnerability tracking and compliance evidence automation can keep remediation and retest records in one place. It does not perform a penetration test. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
