💼 11.4.6 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.
-
Contextual name: 💼 11.4.6 If segmentation is used to isolate the CDE from other networks, penetration tests are performed on segmentation controls.
-
ID:
/frameworks/pci-dss-v4.0/11/04/06 -
Located in: 💼 11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.
Description​
Additional requirement for service providers only.
As follows:
- At least once every six months and after any changes to segmentation controls/methods.
- Covering all segmentation controls/methods in use.
- According to the entity's defined penetration testing methodology.
- Confirming that the segmentation controls/methods are operational and effective, and isolate the CDE from all out-of-scope systems.
- Confirming effectiveness of any use of isolation to separate systems with differing security levels (see Requirement 2.2.3).
- Performed by a qualified internal resource or qualified external third party.
- Organizational independence of the tester exists (not required to be a QSA or ASV).
Similar​
- Sections
/frameworks/pci-dss-v3.2.1/11/03/04/01/frameworks/pci-dss-v4.0.1/11/04/06
- Internal
- ID:
dec-c-23422505
- ID:
Similar Sections (Take Policies From)​
Similar Sections (Give Policies To)​
Sub Sections​
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|