PCI DSS v4.0/Requirement 11: Test Security of Systems and Networks Regularly/204 of 250
11.4.2External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected
Control family: Requirement 11: Test Security of Systems and Networks Regularly
Control description
Defined Approach Requirements:
Internal penetration testing is performed:
- Per the entity's defined methodology.
- At least once every 12 months.
- After any significant infrastructure or application upgrade or change.
- By a qualified internal resource or qualified external third-party.
- Organizational independence of the tester exists (not required to be a QSA or ASV).
Defined Approach Testing Procedures:
11.4.2.a Examine the scope of work and results from the most recent internal penetration test to verify that penetration testing is performed in accordance with all elements specified in this requirement.
11.4.2.b Interview personnel to verify that the internal penetration test was performed by a qualified internal resource or qualified external third-party and that organizational independence of the tester exists (not required to be a QSA or ASV).