If credit card data touches your environment in any form, PCI DSS almost certainly applies to you — here's what the testing requirement actually asks for, in plain language.
PCI DSS requirement 11.3 requires both internal and external penetration testing, conducted at least annually and after any significant change to your environment. This isn't a one-time checkbox — it's an ongoing obligation tied to how your infrastructure actually evolves.
If your business relies on network segmentation to reduce the scope of systems subject to PCI DSS, segmentation testing is also required to confirm that segmentation is actually working as intended, not just configured correctly on paper.
Auditors and assessors want a report that documents methodology, scope, findings, and remediation steps — not just a raw list of vulnerabilities pulled from a scanning tool. The report needs to demonstrate that testing was actually performed by a qualified person using a defensible methodology, not just that a tool was run.
We structure our reporting with that documentation requirement in mind from the start of scoping, rather than trying to retrofit a standard report into compliance format after the fact.
PCI DSS treats vulnerability scanning and penetration testing as two separate, distinct requirements — not interchangeable options. Scanning is typically required quarterly and can be largely automated; penetration testing requires active, hands-on exploitation attempts by a qualified tester and happens less frequently but goes considerably deeper.
No. PCI DSS 11.3 specifically requires penetration testing, which involves active exploitation attempts by a qualified tester — not just automated vulnerability scanning, which is a separate, additional requirement under a different section.
At minimum annually, and after any significant change to your environment that could affect security, such as a new application, a major infrastructure change, or a network redesign.
The standard doesn't mandate a specific certification, but assessors generally expect demonstrated expertise and a defensible methodology — documentation of the tester's approach matters as much as any individual credential.