Penetration Testing

Applies to. The 11.4.x controls in Requirement 11 set the terms. 11.4.1 requires a documented methodology with industry-accepted approaches, coverage of the entire CDE perimeter and critical systems, testing from inside and outside the network, testing of segmentation controls, application-layer testing for at least the vulnerabilities listed in 6.2.4, network-layer testing, review of threats seen in the last 12 months, a documented approach to the risk of findings, and retention of results for 12 months. Internal (11.4.2) and external (11.4.3) tests run at least once every 12 months and after any significant infrastructure or application change, by a qualified internal resource or external third party with organisational independence; 11.4.4 requires exploitable findings to be corrected according to the entity's risk assessment under 6.3.1 and the test repeated; segmentation controls are tested under 11.4.5 (every 12 months and after changes) and 11.4.6 (every six months for service providers); and multi-tenant service providers must support their customers' external testing under 11.4.7.

Limits. The tester does not have to be a QSA or ASV; 11.4.2, 11.4.3 and 11.4.5 ask only for a qualified resource with organisational independence. A vulnerability scan does not satisfy these controls: the methodology must include application-layer and network-layer penetration testing, and 11.4.4 requires exploitable findings to be corrected and the test repeated.