External testing
From the internet, against the perimeter of the cardholder data environment.
- Every exposed service and interface
- Perimeter devices and remote access
- Public-facing applications
- Exploitation proved, not inferred
This is a hard requirement with numbers attached, which makes it one of the easier ones to scope honestly. Requirement 11.4 asks for a documented methodology, external and internal testing at least every twelve months and after any significant change, segmentation testing, and the correction and retesting of exploitable findings. The part people do not know: the standard says the tester must be qualified and organisationally independent, and states that they need not be a QSA.
11.4.1 requires a documented methodology, and it is specific enough to be used as a checklist: industry-accepted approaches, coverage of the cardholder data environment perimeter and critical systems, testing from both inside and outside the network, validation of segmentation and scope-reduction controls, application-layer testing covering at least the vulnerabilities in requirement 6.2.4, network-layer testing across all components, review of threats from the last twelve months, and retention of results.
11.4.2 and 11.4.3 then require internal and external penetration testing at least once every twelve months and after any significant change. 11.4.4 requires exploitable findings to be corrected and the testing repeated to verify the correction. 11.4.5 requires segmentation controls to be tested at least annually. And 11.4.6 tightens that to every six months for service providers, which is the deadline most often missed because it does not line up with the annual assessment.
Laid out in the order requirement 11.4.1 lists it, so your assessor can read the report against the clause.
From the internet, against the perimeter of the cardholder data environment.
From inside the network, which is a separate requirement.
Proving the boundary that is reducing your scope actually exists.
At minimum the vulnerabilities named in requirement 6.2.4.
A requirement, not a courtesy.
Documented, followed and handed over.
The scope of the test follows the scope of your cardholder data environment, not the other way round.
In writing, against 11.4.1, before testing starts.
All three parts, with exploitation proved rather than inferred.
Required by 11.4.4, included in the price.
A report laid out against the clause, with the evidence retained.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows PCI DSS v4.0.1 requirement 11.4, OWASP Web Security Testing Guide, NIST SP 800-115 and PTES, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our compliance and audit service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
No. PCI DSS requires the tester to be qualified and organisationally independent, and states explicitly that they need not be a QSA or ASV. What your assessor will ask to see is the methodology, the scope, the findings and the evidence that exploitable findings were corrected and retested.
Every six months, and after any change to segmentation controls - requirement 11.4.6. That is twice as often as the annual requirement under 11.4.5 that applies to everyone, and it is the deadline most often missed because it does not line up with the annual assessment cycle.
The standard ties the retest to significant changes without giving you a list, which means your assessor’s view is what counts. In practice: a new or substantially rebuilt application in the environment, a network or infrastructure change affecting scope, a move of hosting, or a new connected entity. Ask your assessor in writing rather than deciding alone.
No. 11.4.2 and 11.4.3 are separate requirements for internal and external testing and both apply. A quote covering only the external side is covering half the requirement, and that is a common way for a cheap price to be reached.
The SAQ A eligibility and requirement text changed with v4.x, so the safest course is to confirm your current obligations with your acquirer in writing rather than relying on what was true at your last assessment. We have written up what changed.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.