💼 11.4.5 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.

Contextual name: 💼 11.4.5 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.
ID: /frameworks/pci-dss-v4.0/11/04/05
Located in: 💼 11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.

Description

As follows:

At least once every 12 months and after any changes to segmentation controls/methods
Covering all segmentation controls/methods in use.
According to the entity's defined penetration testing methodology.
Confirming that the segmentation controls/methods are operational and effective, and isolate the CDE from all out-of-scope systems.
Confirming effectiveness of any use of isolation to separate systems with differing security levels (see Requirement 2.2.3).
Performed by a qualified internal resource or qualified external third party.
Organizational independence of the tester exists (not required to be a QSA or ASV).

Sections
- /frameworks/pci-dss-v3.2.1/11/03/04
- /frameworks/pci-dss-v4.0.1/11/04/05

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v3.2.1 → 💼 11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to segmentation controls/methods to verify that the segmentation methods are operational and effective, and isolate all out-of-scope systems from systems in the CDE.	1
💼 PCI DSS v4.0.1 → 💼 11.4.5 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v3.2.1 → 💼 11.3.4 If segmentation is used to isolate the CDE from other networks, perform penetration tests at least annually and after any changes to segmentation controls/methods to verify that the segmentation methods are operational and effective, and isolate all out-of-scope systems from systems in the CDE.	1
💼 PCI DSS v4.0.1 → 💼 11.4.5 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.

Section	Sub Sections	Internal Rules	Policies	Flags