PCI DSS 11.4

What it means

PCI DSS requirement 11.4 is the part of the card standard that requires penetration testing. Both external testing (from outside your network) and internal testing must be done regularly, and exploitable vulnerabilities found must be corrected. The testing has to follow a defined, industry-accepted method.

It is a requirement of the PCI DSS standard, which covers businesses that handle payment card data. The sub-requirements set a rhythm: test at least every twelve months, test again after significant changes, and prove that fixes worked by testing again.

Why it matters

If you fall under the standard, a missing or weak test is a finding in your assessment. Banks and card brands can ask a business to fix gaps, and a failed assessment can hold up deals with payment partners. A plain vulnerability scan does not satisfy it, because 11.4 expects testing that tries to exploit weaknesses.

It also improves the result for your own sake. A penetration test shows how weaknesses chain together around the systems that hold card data. That is the picture an assessor wants, and the one you need before an attacker finds the same chain.

How it shows up

The test scope includes the cardholder data environment, its perimeter and critical systems, and tests both the network layer and the application layer. If you use network segmentation to shrink scope, 11.4 also expects tests that confirm the segmentation holds. Service providers have a more frequent segmentation test.

The usual mistakes: scoping out the checkout application because it is hosted by someone else, treating a scan as a test, testing once and never after a big release, and never checking that fixes worked. The standard expects retesting, so keep the retest result with the original report as evidence.