PCI DSS v4.0/Requirement 11: Test Security of Systems and Networks Regularly/205 of 250
11.4.3External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected
Control family: Requirement 11: Test Security of Systems and Networks Regularly
Control description
Defined Approach Requirements:
External penetration testing is performed:
- Per the entity's defined methodology.
- At least once every 12 months.
- After any significant infrastructure or application upgrade or change.
- By a qualified internal resource or qualified external third party.
- Organizational independence of the tester exists (not required to be a QSA or ASV).
Defined Approach Testing Procedures:
11.4.3.a Examine the scope of work and results from the most recent external penetration test to verify that penetration testing is performed according to all elements specified in this requirement.
11.4.3.b Interview personnel to verify that the external penetration test was performed by a qualified internal resource or qualified external third-party and that organizational independence of the tester exists (not required to be a QSA or ASV).