Red Team
PCIComplianceHubLast updated
A group of security professionals that simulate real-world attacks on an organization's systems and networks to identify vulnerabilities and weaknesses. Red team exercises can support PCI DSS compliance efforts by providing valuable insights into the security of the cardholder data environment.
Applies to. PCI DSS v4.0.1 does not name red teams. The nearest thing it asks for is penetration testing under Requirement 11, which may be carried out by a qualified internal team provided it is organisationally independent of the systems tested. A red team exercise can stand in for the penetration test only if it follows the entity's documented methodology and covers what the standard requires, including the entire CDE perimeter, testing from inside and outside the network and any segmentation controls; a narrow, objective-driven exercise usually does not.
Related. Penetration Testing, Organizational Independence, Social Engineering, Segmentation Penetration Testing, Attack Surface
Sources. PCI DSS v4.0.1 (June 2024)