PCI DSS Requirement 11.4 Penetration Testing from Your ASV

What Requirement 11.4 actually says

11.4.1: You have a documented penetration testing methodology, covering the whole cardholder data environment and its boundaries, that includes application and network testing.
11.4.2: Internal penetration testing at least every 12 months and after any significant infrastructure or application change.
11.4.3: External penetration testing at least every 12 months and after any significant infrastructure or application change.
11.4.4: Exploitable vulnerabilities found by testing are corrected and the fix is verified by retesting.
11.4.5: If you use segmentation to isolate the cardholder data environment, segmentation controls are tested at least every 12 months and after any change to them.
11.4.6: Service providers test segmentation at least every six months and after any change.
11.4.7: Multi-tenant service providers support their customers' testing.

A penetration test is not the same as your quarterly ASV scan. Requirement 11.3 covers scanning; 11.4 covers testing. You need both.

Who can perform it: a qualified internal resource or a qualified external third party that is organizationally independent from the systems being tested. The tester does not have to be a QSA or an ASV. PCI SSC's penetration testing guidance is also clear that running an automated tool by itself does not satisfy the requirement; a qualified tester has to interpret the results and decide whether more testing is needed.

The engineer-led Requirement 11.4 engagement

For a Report on Compliance, an SAQ D, or any assessment where your QSA wants a human-performed test, Clone Systems scopes an engineer-led penetration test to your cardholder data environment.

Scoping call and a fixed statement of work that names the CDE scope, the internal and external perspectives and the application-layer testing, so your QSA can match the report to 11.4.1.
Segmentation testing (11.4.5, and every six months for service providers under 11.4.6): we attempt to reach the CDE from your out-of-scope networks and document the result, which is the evidence assessors most often find missing.
Qualified, independent testers: Clone Systems engineers are organizationally independent from your environment, and across the team hold CISSP, CMMC CCP, APIsec University API Penetration Testing, Hack The Box Dante Pro Lab, Zero-Point Security and TCM Security Practical Malware Analysis credentials.
A QSA-ready report with methodology, severity ratings, proof of exploit and remediation for every finding, and a free remediation retest to satisfy 11.4.4.
Remote delivery for every test type; Clone Systems does not perform on-site testing.

Getting it done this week

Clone Systems sells both halves of 11.4 online. Automated external penetration testing performs the external testing in 11.4.3 against the perimeter scope you define, and automated internal penetration testing performs the internal testing in 11.4.2 against up to 250 live hosts through a virtual appliance. Both start the same day, attempt real exploitation with proof of exploit, include authenticated web application testing on the external test, and include retests inside the 30-day window, which is how they support 11.4.4. They fit SAQ A-EP merchants and other scopes where the assessor accepts an automated test for the defined perimeter. Your assessor decides what satisfies 11.4 for your environment; for a Report on Compliance, segmentation testing, or any test where your QSA requires a human tester, use the engineer-led engagement above.

Why Clone Systems

If you already use Clone Systems for ASV scans, the Requirement 11.4 penetration test comes from the same vendor and the same portal: quarterly ASV scans under 11.3.2 and the annual penetration test under 11.4 are separate requirements, and Clone Systems is one of the few PCI Approved Scanning Vendors that sells both online. A PCI Approved Scanning Vendor since 2007. The same company that runs your quarterly ASV scans can run your annual penetration test, and your QSA gets one consistent set of reports.

Not sure which test you need? Answer a few questions.

Will your auditor accept it? See what is in the report.

Buy a pen test and start today · Request managed pen test scoping

PCI DSS penetration testing FAQ

Do I need a penetration test if I already have PCI ASV scans?

If Requirement 11.4 applies to your SAQ or Report on Compliance, yes. ASV scans satisfy 11.3.2 and a penetration test satisfies 11.4; they are separate requirements with separate evidence, and passing one does not cover the other. SAQ A merchants need ASV scans but no penetration test; SAQ A-EP, SAQ D merchants and SAQ D service providers need both.

Who is allowed to perform a PCI penetration test?

A qualified internal resource or a qualified external third party that is organizationally independent from the systems under test. PCI DSS does not require the tester to be a QSA or an ASV, and it does not name a specific certification. Clone Systems engineers are independent of your environment and hold recognized offensive security credentials across the team.

Does an automated penetration test satisfy Requirement 11.4?

Not on its own. PCI SSC's penetration testing guidance says running a tool is not enough and a qualified tester must interpret the results. Clone Systems' automated test performs the external and internal testing against the scope you define and produces a report with proof of exploit and retest evidence; your assessor decides whether that meets 11.4 for your environment. Where it does not, or where segmentation testing is required, use the engineer-led engagement.

What is segmentation testing and do I need it?

If you use network segmentation to keep systems out of PCI scope, 11.4.5 requires a test that attempts to reach the cardholder data environment from those out-of-scope networks, at least every 12 months and after any change to the segmentation controls. Service providers must test every six months under 11.4.6. Clone Systems engineers perform segmentation testing as part of the engineer-led engagement.

How often is penetration testing required?

Internal and external testing at least once every 12 months and after any significant change to infrastructure or applications. Segmentation testing every 12 months, or every six months for service providers. Exploitable findings must be corrected and retested.

What does my QSA want to see in the report?

The documented methodology, the scope with the CDE boundary, internal and external results, application-layer findings, severity ratings with evidence, segmentation test results where applicable, and proof that exploitable findings were fixed and retested. Clone Systems reports are built around those items; a sample is available on the penetration test report page.

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.

Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing and web application penetration testing.

Which SAQs require a penetration test?.

Penetration testing for PCI DSS Requirement 11.4