PCI DSS penetration testing
PCI DSS penetration testing evaluates the security of your cardholder data environment and its boundaries. Requirement 11.4 covers internal and external testing, with segmentation testing where applicable. Balhence agrees the scope, methodology, and access with your team and provides human-verified findings and agreed re-test evidence for review.
What PCI DSS v4.0.1 requires: requirement 11.4
- A documented, industry-accepted penetration testing approach covering relevant application and network layers.
- Internal and external penetration testing at least once every 12 months and after significant infrastructure or application upgrades or changes.
- Qualified testers with organizational independence; scope and qualifications should be reviewed before engagement.
- Correction of exploitable vulnerabilities and repeated testing to verify those corrections.
Confirm applicability with your QSA or compliance owner using the current PCI SSC standard and supporting documents.
Scoping your cardholder data environment
Identify systems that store, process, or transmit cardholder data, connected systems, and controls that affect their security. Record internal and external perspectives, network boundaries, application layers, and dependencies. Agree which systems and interfaces must be exercised and where exclusions need reviewer approval. Where these are in scope, align the boundary with web application testing and API testing.
Our network and infrastructure assessment can be included where the agreed PCI scope requires it.
PCI DSS segmentation testing
Where segmentation is used to isolate the CDE, test the controls relied upon to exclude other systems. Requirement 11.4.5 calls for this at least annually and after changes to segmentation controls or methods. For service providers, 11.4.6 adds testing at least every six months and after those changes.
Document which boundaries were checked and any limitations. Coordinate testing windows, controlled access, operational limits, and urgent contacts before the work starts.
Prepare for PCI DSS penetration testing
Provide the current CDE boundary, relevant data-flow and network diagrams, connected systems, application inventory, and the segmentation controls relied on for scope reduction.
Identify the internal and external testing perspectives, the access that will be available, and recent infrastructure or application changes. Confirm whether service-provider requirements apply with your assessor.
Agree evidence handling, operational limits, urgent contacts, and how corrections will be verified. Document any access limitation or exclusion so your reviewer can assess its effect on coverage. Bring your boundary and constraints to a PCI DSS testing scoping discussion.
PCI pentest reports and remediation evidence
- An executive summary separating the agreed internal, external, and applicable segmentation scope, test dates, methodology, and coverage limits.
- Human-verified findings with impact, prerequisites, evidence, severity reasoning, and practical fixes.
- A report walkthrough and an agreed route for urgent findings.
- A bounded re-test of agreed fixes when included in the agreement, with each finding recorded as fixed, partially fixed, not fixed, or not re-tested.
- The assessed CDE boundaries and permitted test perspectives, including inaccessible systems, unassessed segments, and limitations relevant to your assessor.
Balhence provides technical evidence related to the agreed requirement 11.4 scope; your assessor determines compliance.
PCI DSS penetration testing FAQ
Is Balhence a QSA or an ASV?
We do not claim QSA or Approved Scanning Vendor status. This service provides penetration testing and evidence for your assessor; QSA assessment and ASV scanning must be arranged with appropriately qualified providers.
Does a penetration test replace an ASV scan?
No. External vulnerability scanning and penetration testing are separate PCI activities. Confirm which requirements apply to your environment and assessment method with your compliance owner.
Is segmentation testing always annual?
Where segmentation is used, PCI DSS 11.4.5 specifies at least annual testing and testing after segmentation changes. Service providers have an additional six-month requirement under 11.4.6.
Confirm your PCI DSS penetration testing scope
Tell us about the systems, roles, integrations, and deadline. We will confirm scope, availability, written authorization, and deliverables before testing.