💼 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity.

Description

Includes:

Industry-accepted penetration testing approaches.
Coverage for the entire CDE perimeter and critical systems.
Testing from both inside and outside the network.
Testing to validate any segmentation and scope-reduction controls.
Application-layer penetration testing to identify, at a minimum, the vulnerabilities listed in Requirement 6.2.4.
Network-layer penetration tests that encompass all components that support network functions as well as operating systems.
Review and consideration of threats and vulnerabilities experienced in the last 12 months.
Documented approach to assessing and addressing the risk posed by exploitable vulnerabilities and security weaknesses found during penetration testing.
Retention of penetration testing results and remediation activities results for at least 12 months.

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 PCI DSS v4.0 → 💼 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity.					no data

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 PCI DSS v4.0 → 💼 11.4.1 A penetration testing methodology is defined, documented, and implemented by the entity.					no data

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance