Home
Penetration testing
PCI DSS penetration testing

PCI DSS penetration testing that satisfies your QSA

Requirement 11.4 is explicit: internal and external tests, annually and after change, plus segmentation testing. We deliver all three, with independent testers and retest evidence.

Get a quote See a sample report

Requirement 11.4PCI DSS v4.0.1

What 11.4 actually requires

11.4.2Internal penetration testing
11.4.3External penetration testing
11.4.4Correct all exploitable findings, then retest
11.4.5Test segmentation controls

Evidence for your QSAQSA-ready

01 · What it requires

PCI DSS names penetration testing — in Requirement 11.4

Unlike SOC 2 and ISO 27001, PCI DSS is explicit. Requirement 11.4 calls for internal and external penetration testing, remediation with a retest, and segmentation testing. Your QSA will check the method and the tester’s independence.

Sub-req

What it requires

How we deliver it

11.4.2

Internal penetration test, at least every 12 months and after significant change

Assumed-breach testing inside the cardholder data environment (CDE)

11.4.3

External penetration test, same cadence

Testing of the CDE perimeter from the internet

11.4.4

Correct exploitable findings and repeat testing to verify

Free retest and an attestation your QSA accepts

11.4.5

Test segmentation controls are effective

Segmentation testing — every 6 months for service providers

Each finding is written for the QSA: the sub-requirement, the proof, the fix and the retest result. See our PCI DSS pentest playbook.

Talk to a PCI consultant

02 · Cadence

Annual, after change, and every six months for segmentation

PCI DSS is specific about how often you test. Miss the cadence and the QSA can’t sign off. Here’s the schedule we build around.

TestAnnualAfter changeEvery 6 moWho

External pentest11.4.3All

Internal pentest11.4.2All

Segmentation test11.4.5Providers: 6-monthly

Service providers test segmentation every six months; merchants, at least annually and after any significant change to the CDE.

Plan your test dates

03 · Independence

Why your QSA checks who ran the test

PCI DSS requires the tester to be organisationally independent of the systems being tested. Using an external provider removes the question entirely — and QSAs scrutinise tester qualifications.

11.4

Organisational independence

An external provider can’t be marking its own homework. That independence is exactly what the QSA is looking for.

11.4

Qualified testers

QSAs scrutinise tester qualifications. Our testers are EU-based and named in the rules of engagement.

11.4.4

Retest evidence

We correct-and-retest, then issue an attestation that exploitable findings are closed — the evidence 11.4.4 demands.

Check your independence

Starting from€4,000

Priced on your CDE and segmentation

A PCI test is scoped to your cardholder data environment. Internal, external and segmentation testing are scoped together. See penetration testing pricing.

Get a fixed quote

05 · Questions

PCI DSS penetration testing FAQ

Get a quote

More in our PCI DSS penetration testing guide and the PCI pentest playbook.

How often does PCI DSS require penetration testing?

Requirement 11.4 calls for internal and external penetration tests at least every 12 months and after any significant change. Service providers must also test segmentation controls every six months; merchants, at least annually.

What does Requirement 11.4 cover?

Internal testing (11.4.2), external testing (11.4.3), correcting exploitable findings and repeating the test to verify (11.4.4), and segmentation testing (11.4.5). We deliver all four and map each finding to its sub-requirement.

Does the tester have to be independent?

Yes. PCI DSS requires the tester to be organisationally independent of the systems being tested, and QSAs scrutinise tester qualifications. Using an external provider like Q-SEC removes any question about independence.

What evidence does the QSA need?

A report tying findings to Requirement 11.4, proof of the method, and — crucially — evidence that exploitable findings were corrected and re-tested. Our free retest and attestation provide that closure.

What is segmentation testing?

If you use network segmentation to reduce PCI scope, 11.4.5 requires you to prove the segmentation actually holds — that systems outside the cardholder data environment genuinely can’t reach inside it. We test those controls directly.

Can one test cover PCI and our other frameworks?

The CDE test can also evidence SOC 2 and ISO 27001 controls where the scope overlaps, though PCI’s cadence and independence rules are the strictest, so we plan around those.