11.4.5External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected

Defined Approach Requirements:

If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls as follows:

- At least once every 12 months and after any changes to segmentation controls/methods

- Covering all segmentation controls/methods in use.

- According to the entity's defined penetration testing methodology.

- Confirming that the segmentation controls/methods are operational and effective, and isolate the CDE from all out-of-scope systems.

- Confirming effectiveness of any use of isolation to separate systems with differing security levels (see Requirement 2.2.3).

- Performed by a qualified internal resource or qualified external third party.

- Organizational independence of the tester exists (not required to be a QSA or ASV).

Defined Approach Testing Procedures:

11.4.5.a Examine segmentation controls and review penetration-testing methodology to verify that penetration-Testing Procedures: are defined to test all segmentation methods in accordance with all elements specified in this requirement.

11.4.5.b Examine the results from the most recent penetration test to verify the penetration test covers and addresses all elements specified in this requirement.

11.4.5.c Interview personnel to verify that the test was performed by a qualified internal resource or qualified external third party and that organizational independence of the tester exists (not required to be a QSA or ASV).