PCI DSS Penetration Testing & Compliance
PCI DSS v4.0.1 requires internal and external penetration testing at least every 12 months and after any significant change (Req 11.4.2, 11.4.3), plus vulnerability scans at least every three months, with external scans by an ASV (Req 11.3). We run the penetration tests and document scope, method, findings, and retest results for your assessor.
What is PCI DSS?
PCI DSS is the global security standard for any organization that touches payment card data. Managed by the PCI Security Standards Council, it sets the baseline for how cardholder data must be stored, processed, and transmitted.
- Managed by the PCI Security Standards Council (PCI SSC)
- Current version is PCI DSS v4.0.1. The requirement numbers on this page were checked against the official v4.0.1 ROC Template r3 (January 2025).
- Applies to merchants that accept cards and to service providers that process or acquire card payments for others, for systems in or connected to the cardholder data environment
- An industry standard; the payment brands run their own enforcement programs
Reference: PCI SSC - https://www.pcisecuritystandards.org/standards/pci-dss/
Who Must Comply with PCI DSS?
PCI DSS covers merchants that accept cards and service providers that process or acquire card payments for others, for every system in or connected to the cardholder data environment.
Merchants
Retail stores, restaurants, hotels, and any business that accepts card payments in person or online
E-Commerce Businesses
Online stores and platforms processing card-not-present transactions through payment gateways
Financial Institutions
Banks, acquiring banks, and card issuers that process, store, or transmit cardholder data
Payment Processors
Third-party processors, payment gateways, and payment service providers handling card transactions
Service Providers
Hosting providers, managed security services, and any entity with access to cardholder data environments
Any Card Data Handler
Any organization that stores, processes, or transmits primary account numbers (PANs) or sensitive authentication data
Key Security Testing Requirements
The testing duties in PCI DSS v4.0.1, with the requirement number for each.
Penetration Testing
Internal and external penetration testing at least every 12 months and after any significant infrastructure or application change. Testing covers the whole CDE perimeter and includes application-layer testing. The tester must be qualified and organizationally independent, and need not be a QSA or ASV.
Remediation and Retest
Fix exploitable vulnerabilities found in penetration testing according to risk, then repeat the test to verify the fixes.
Segmentation Testing
If you use segmentation to reduce scope, test the segmentation controls every 12 months (merchants) or every 6 months (service providers), and after any change to segmentation controls.
Vulnerability Scanning
Authenticated internal scans at least every three months and after significant change, with rescans until high-risk and critical findings are resolved. External scans by an ASV at least every three months until the scan passes. After significant change, external scans by a qualified, independent tester resolve findings scored CVSS 4.0 and above.
Code Review Before Release
Review bespoke and custom software against secure coding guidelines for existing and emerging vulnerabilities before release to production or to customers, and fix findings. Manual reviews need a reviewer other than the author and management approval.
Multi-Tenant Service Providers
Multi-tenant service providers support their customers in running external penetration tests.
Who Enforces PCI DSS
PCI DSS is an industry standard, and the payment brands run their own enforcement programs.
Consequences for non-compliance come from the payment brands and their enforcement programs.
Before you plan testing, confirm with your acquirer or the payment brands which validation and reporting apply to your organization.
How Pentesting Maps to PCI DSS
Every type of penetration test addresses specific PCI DSS controls. Here is the requirement each one relates to.
PCI DSS Compliance Checklist
Items with a requirement number come from PCI DSS v4.0.1. Items without one are Reconix recommendations.
Official References
Consult the original documentation for full PCI DSS requirements.
Related Security Services
Testing services for your cardholder data environment.
PCI DSS Penetration Testing FAQ
Common questions about penetration testing and security requirements for PCI DSS compliance.
Prepare for Your PCI DSS Assessment
Penetration testing and internal vulnerability scanning aligned with PCI DSS v4.0.1, with reports that document scope, method, findings, and retest results for your assessor.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.