💼 11.3 Implement a methodology for penetration testing.

• Contextual name: 💼 11.3 Implement a methodology for penetration testing.

• ID: /frameworks/pci-dss-v3.2.1/11/03

• Located in: 💼 11 Regularly test security systems and processes.

Description

Includes the following:

• Is based on industry-accepted penetration testing approaches (for example, NIST SP800-115)
• Includes coverage for the entire CDE perimeter and critical systems
• Includes testing from both inside and outside the network
• Includes testing to validate any segmentation and scope-reduction controls
• Defines application-layer penetration tests to include, at a minimum, the vulnerabilities listed in Requirement 6.5
• Defines network-layer penetration tests to include components that support network functions as well as operating systems
• Includes review and consideration of threats and vulnerabilities experienced in the last 12 months
• Specifies retention of penetration testing results and remediation activities results.

Similar

• Sections
  • /frameworks/pci-dss-v4.0/11/04/01
• Internal
  • ID: dec-c-3cd8dff5

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity.

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity.

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 11.3.1 Perform external penetration testing at least annually and after any significant infrastructure or application upgrade or modification.
💼 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification.
💼 11.3.3 Exploitable vulnerabilities found during penetration testing are corrected and testing is repeated to verify the corrections.
💼 11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to segmentation controls/methods to verify that the segmentation methods are operational and effective, and isolate all out-of-scope systems from systems in the CDE.	1
💼 11.3.4.1 If segmentation is used, confirm PCI DSS scope by performing penetration testing on segmentation controls at least every six months and after any changes to segmentation controls/methods.