Short answer
Yes, for most entities that store, process, or transmit card data. PCI DSS v4.0.1 requirement 11.4 asks for internal and external penetration tests at least every 12 months and after significant changes, plus segmentation testing if you use segmentation to reduce scope. Whether it applies to you depends on your self-assessment questionnaire or report on compliance. SAQ A merchants are the main exception: see which SAQs include it below.
PCI DSS v4.0.1 is the current version. It was published in June 2024 as a limited revision, v4.0 was retired on 31 December 2024, and the requirements that were future-dated became mandatory on 31 March 2025. Read the official text in the PCI SSC document library and the v4.0.1 announcement.
Requirement 11.4 in plain terms
| Requirement | What it asks for |
|---|---|
| 11.4.1 | A documented methodology based on an industry-accepted approach. It covers the whole cardholder data environment (CDE) perimeter and critical systems, tests from inside and outside the network, validates segmentation, and includes application-layer and network-layer tests. Results are kept for at least 12 months. |
| 11.4.2 | Internal penetration test at least once every 12 months and after any significant infrastructure or application change. |
| 11.4.3 | External penetration test on the same schedule. |
| 11.4.4 | Exploitable vulnerabilities are corrected according to your risk ranking (requirement 6.3.1), and the test is repeated to verify the fixes. |
| 11.4.5 | If segmentation isolates the CDE, it is tested at least every 12 months and after changes to segmentation controls. |
| 11.4.6 | Service providers test segmentation every six months. |
| 11.4.7 | Multi-tenant service providers support their customers' external penetration testing, either with evidence such as redacted results or with prompt access to test. Mandatory since 31 March 2025. |
For the application layer, see web application and API penetration testing, which start at $3,000.
"Internal" in PCI terms means testing inside the CDE and into it from your other networks, trusted and untrusted. "Network-layer" covers every component that supports network functions, and operating systems.
Which SAQs include penetration testing
If you validate with a self-assessment questionnaire, the SAQ lists the requirements you answer. The 11.4 rows differ by type:
| SAQ | Penetration testing rows |
|---|---|
| A | None (quarterly ASV scans still apply) |
| A-EP | 11.4.1, 11.4.3, 11.4.4, 11.4.5 (external, not internal) |
| B-IP, C | 11.4.5 segmentation testing only |
| C-VT, P2PE | None |
| D for merchants | 11.4.1 to 11.4.5 |
| D for service providers | 11.4.1 to 11.4.7 |
The January 2025 revision of SAQ A removed requirements 6.4.3 and 11.6.1 and added an eligibility criterion that your site is not susceptible to attacks from scripts; see the PCI SSC announcement. Always check the current SAQ for your channel in the document library before you scope.
Segmentation testing
Segmentation is how most companies keep PCI scope small: the CDE sits in its own network zone, and everything else is out of scope only if it truly cannot reach it. Requirement 11.4.5 asks you to prove that. A good segmentation test probes from every out-of-scope segment toward every CDE range and records, for each pair, whether traffic was delivered or blocked.
Helix records that evidence as contrast pairs from the same position, one path expected to pass and one expected to be blocked, so a misread firewall rule shows up straight away. See network penetration testing for how internal tests run.
Who can perform the test
PCI DSS asks for a qualified internal resource or a qualified external third party, and the tester must be organizationally independent of the systems under test. It does not require a QSA or an ASV. Your assessor may ask how the tester is qualified and how independence is achieved, so keep that in the report.
The PCI SSC Penetration Testing Guidance supplement is useful background on methodology and qualifications. It dates from 2017, uses the older v3.2 numbering (11.3), and does not replace the standard.
ASV scans vs penetration tests
These are two different requirements, and one does not replace the other. Requirement 11.3.2 asks for quarterly external vulnerability scans by an Approved Scanning Vendor, repeated until they pass. A scan reports known vulnerable versions and misconfigurations. Requirement 11.4 asks for a penetration test, which tries to exploit weaknesses and chain them into access to card data.
Evidence for your assessor
Your assessor asks for the report and the trail behind it.
What the Helix report carries
- The methodology, and how it maps to 11.4.1.
- Scope: the CDE perimeter, critical systems, and the segments tested from.
- Test dates, so the 12-month cadence can be checked.
- Findings rated by risk, with evidence for each.
- Segmentation results for each segment pair.
- Retest results for every fix, as 11.4.4 requires.
What you add
- Your notes on the tester's qualifications and independence.
- The remediation record, following your 6.3.1 risk ranking.
- Retention of all of it for at least 12 months.
PCI DSS pentest planning checklist
You know which SAQ or report on compliance applies, and which 11.4 rows it includes.
The CDE and every connected segment are mapped to named address ranges.
Positions to test from are agreed for each out-of-scope segment.
Significant changes since the last test are listed, since they can trigger a new test.
The tester's qualifications and independence are documented.
Remediation owners follow your 6.3.1 risk ranking.
The retest fits before your assessment date.
Reports and retest results are stored for at least 12 months.
Frequently asked questions
How often does PCI DSS require penetration testing?
Internal and external penetration tests are required at least once every 12 months and after any significant infrastructure or application upgrade or change (requirements 11.4.2 and 11.4.3). Segmentation controls must be tested at least every 12 months, and every six months for service providers.
Does a PCI pentest have to be done by a QSA?
No. PCI DSS requires a qualified internal resource or a qualified external third party, with organizational independence from the systems being tested. The tester does not need to be a QSA or an ASV.
Is an ASV scan the same as a PCI penetration test?
No. Quarterly external scans by an Approved Scanning Vendor are a separate requirement (11.3.2). A scan does not satisfy requirement 11.4, which asks for a penetration test that tries to exploit weaknesses from inside and outside the network.
Do SAQ A merchants need a penetration test?
Not under the current SAQ A, which has no requirement 11.4 rows. SAQ A merchants still need quarterly ASV scans. Merchants on SAQ A-EP or SAQ D do need penetration testing, and SAQ C and SAQ B-IP include segmentation testing.
What happens if the pentest finds vulnerabilities?
Requirement 11.4.4 says exploitable vulnerabilities must be corrected according to your risk ranking under requirement 6.3.1, and the test repeated to verify the fixes. Keep the original report, the remediation record, and the retest result together.
How much does a PCI DSS penetration test cost?
It depends on the size of the cardholder data environment and how many segments it has. Helix external network tests start at $3,000 USD, internal tests at $4,000 USD, and white-box tests at $7,000 USD, with free unlimited retesting so the 11.4.4 retest costs nothing extra.