Requirement 11.4 is now mandatory — and most teams don't know what QSAs actually expect to see. This playbook breaks down every sub-requirement, all 5 testing domains, and the segmentation traps that cause audit failures.
✦ Req 11.4 decoded — all 7 sub-requirements explained
✦ 5 testing domains with scope and method guidance
✦ Segmentation validation: what counts, what doesn't
✦ 12-point pre-test readiness checklist
✦ 90-day timeline from kickoff to QSA-ready report
⭐⭐⭐⭐⭐ Used by security teams at fintech companies, payment processors, and banks preparing for QSA audits.
PCI DSS v4.0 raised the bar significantly. These are the uncertainties we hear most often from fintech teams and compliance leads.
The transition from v3.2.1 isn't cosmetic. Scope requirements expanded, methodology must now be documented and named, APIs are explicitly included, and multi-tenant platforms have brand-new obligations under Req 11.4.6–7.
Most pen test engagements miss connected-to systems — AD environments, monitoring platforms, CI/CD pipelines — that QSAs flag as in scope. Narrow scope is the single most common reason certifications are delayed.
Missing CVSS scores, unnamed methodology, no segmentation test results, and absent retest attestation are the top reasons pen test reports generate RFIs. This playbook tells you exactly what auditors need.
v4.0 replaced v3.2.1 entirely in March 2024. These are the changes with the most impact on penetration testing scope, methodology, and obligations.
Your pen testing methodology must now be documented and reference a named standard: NIST SP 800-115, PTES, OWASP Testing Guide, or OSSTMM. Ad hoc testing no longer satisfies Req 11.4.1.
v4.0 explicitly names APIs as in-scope system components. Payment APIs, webhooks, reporting endpoints, and microservice APIs connected to the CDE must be tested under Req 6.4.2 and 11.4.
Req 11.4.6–7: multi-tenant service providers must support customers in external pen testing — either by testing on their behalf or enabling self-testing. This is new and has no v3.2.1 equivalent.
Segmentation testing must now also confirm isolation between systems at differing security levels — not just isolation of out-of-scope systems from the CDE. Dev, staging, and corporate networks are now relevant.
v4.0 makes retest verification explicit: Critical and High findings must be retested by the original tester or independent party, with documented attestation. Self-certification by the client does not satisfy Req 11.4.4.
Req 6.4.2 requires an automated technical solution that detects and prevents web application attacks. This must be validated through active testing — configuration review alone is insufficient under v4.0.
A compliant pen test is not a single-surface assessment. Every vector through which an attacker could reach cardholder data must be tested and documented.
Internet-exposed attack surface: public IPs, payment gateway endpoints, cloud ingress/egress, and web application perimeter.
Req 11.4.2All systems inside the perimeter connected to or supporting the CDE: servers, databases, jump hosts, admin consoles, internal APIs.
Req 11.4.3All payment interfaces and APIs: OWASP Top 10 + API Top 10, IDOR, broken auth, business logic flaws, JWT attacks, webhook abuse.
Req 6.4.2 + 11.4Active confirmation that out-of-scope systems cannot reach the CDE, and that differing security levels are properly isolated.
Req 11.4.5AWS, Azure, GCP: IAM policies, storage, compute, containers, serverless, and API gateways in the CDE data path.
Req 11.4 + Cloud Guidance17 pages of clear, regulation-grounded guidance — built around how QSAs actually evaluate PCI DSS pen test evidence under v4.0.
Side-by-side comparison of v3.2.1 vs v4.0 pen testing requirements with practical impact analysis.
8-item checklist of system categories that regularly get excluded and then flagged by QSAs.
What each sub-requirement mandates and what it means in practice for your programme.
Every testing domain: what's in scope, which techniques are used, which requirement it satisfies.
What effective segmentation means under v4.0, how it's tested, and the most common failures.
Who this applies to, what you must do, and what evidence your QSA will accept.
Reduce testing time by 30% and avoid the most common findings that generate remediation cycles.
Required report elements, common RFI triggers, and the top 5 failures that delay PCI certification.
Network segmentation is how most fintech companies reduce PCI scope. But having controls in place is not the same as proving they work. Under v4.0, you must actively test them — with documented results.
Q-Sec's segmentation testing goes beyond configuration review. We simulate attacks from out-of-scope systems, identify dual-homed hosts that bridge CDE and non-CDE networks, and produce QSA-format evidence for every path tested.
Most organisations aren't — and pay for it in extended testing cycles and delayed AOC issuance. Here's a preview of the checklist inside the playbook:
Download Full Checklist →Q-Sec's reporting is structured to be actionable at every level — from the engineering team remediating findings to the board receiving the compliance summary.
Instant download. Used by security teams at payment processors, fintech platforms, and banks across Europe and North America. Written to reflect how QSAs actually evaluate v4.0 compliance.
🔒 No spam. Unsubscribe anytime. Q-Sec is here when you need a pen test — not before.
©2026 Q-SEC. All rights reserved. Privacy Policy
