Pentesting for PCI DSS 4.0.1 – Here’s everything you need to know

Posted on by Bogdan Tiron
REGULATIONS Pentesting for PCI DSS 4.0.1 Everything You Need to Know About Payment Card Security Testing 1 Requirement 11.4 Annual penetration testing 2 ASV Scanning Quarterly vulnerability scans 3 Segmentation Network segmentation validation 4 Remediation 30-day critical fix window External Network Internal Network Web Applications Segmentation Controls Wireless Networks fortbridge.co.uk

PCI DSS 4.0.1 is the current version of the Payment Card Industry Data Security Standard, published in June 2024. It sets security requirements for any organisation that stores, processes, or transmits cardholder data. Penetration testing is a mandatory part of compliance under Requirement 11.4.

Table of contents

What PCI DSS Is

The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the PCI Security Standards Council. It applies to merchants, payment processors, banks, and any entity handling payment card data. Version 4.0.1 replaced version 4.0 (which itself succeeded 3.2.1) and includes clarification updates to improve understanding of the requirements. Full compliance with PCI DSS 4.0.1 has been required since 31 March 2025.

Pentesting Requirements

Requirement 11.4 of PCI DSS 4.0.1 mandates regular penetration testing. The key obligations are:

  • Annual internal and external penetration tests covering the entire cardholder data environment (CDE) perimeter and critical systems
  • Additional pentesting after any significant infrastructure or application changes
  • Network segmentation validation every six months for service providers
  • Full-stack testing scope: networks, applications (including APIs), cloud and hybrid environments
  • Testing must be conducted by qualified internal staff or external providers with certifications such as CREST, OSCP, OSCE, or OSEP
  • Exploitable vulnerabilities must be remediated and retested, with results retained for at least 12 months
PCI DSS 3.2.1 vs 4.0/4.0.1 – Key Changes Penetration Testing & Vulnerability Management Updates PCI DSS 3.2.1 (Previous) PCI DSS 4.0 / 4.0.1 (Current) 1 Internal Vulnerability Scans Non-authenticated scans acceptable 1 Authenticated Scanning Required Credentialed scans for accurate results (Req 11.3.1.2) NEW 2 Segmentation Testing Annually for service providers 2 Every 6 Months for Service Providers Increased frequency – biannual segmentation checks CHANGED 3 Multi-Tenant Environments No specific requirements 3 Specific Pentest Requirements Tenant isolation & shared service testing (Req 11.4.7) NEW 4 Compensating Controls Rigid compensating control worksheets 4 Customized Approach Flexible alternative controls to meet objectives CHANGED 5 Testing Frequency Prescriptive – fixed schedules only 5 Targeted Risk Analysis Orgs define some frequencies based on risk (Req 12.3.1) NEW COMPLIANCE DEADLINE 31 March 2025 – Full PCI DSS 4.0.1 Compliance Required

Key Changes in v4.0

PCI DSS 4.0 introduced several changes that affect pentesting and security operations:

  • Customized approach – Organisations can now use alternative controls to meet the intent of a requirement, replacing the rigid compensating controls model
  • Authenticated scanning – Internal vulnerability scans must now use credentials for more accurate results (Req 11.3.1.2)
  • E-commerce security – Weekly checks required to confirm third-party scripts on payment pages are not tampered with
  • MFA expansion – Multi-factor authentication now required for all access to cardholder data, not only remote access
  • Targeted risk analysis – Organisations can define certain testing frequencies based on their own risk assessments (Req 12.3.1)
PCI DSS 4.0.1 – Annual Compliance Cycle Testing Frequencies & Remediation Windows JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC ASV ASV ASV ASV PT ANNUAL CYCLE PCI DSS 4.0.1 Req. 11.3 & 11.4 Q1 Q2 Q3 Q4 QUARTERLY ASV External Vulnerability Scans Approved Scanning Vendor – external-facing systems ANNUALLY Full Penetration Test Internal + external, network + application layer ANNUALLY Internal Vulnerability Scans Authenticated scans across all in-scope systems AFTER CHANGES Significant-Change Pentest Infrastructure, application, or network changes 30 DAYS Critical / High vulns 90 DAYS Medium vulns
PCI DSS 4.0.1 – Penetration Testing Scope Requirement 11.4: Defining In-Scope Systems & Boundaries OUT-OF-SCOPE SYSTEMS (Properly segmented – no CDE access) HR Systems Employee portals Marketing Systems CMS, analytics Dev/Test Env Non-production Guest Wi-Fi Isolated network CONNECTED-TO SYSTEMS (Connectivity to CDE – In Scope) Active Directory Authentication DNS Servers Name resolution Monitoring SIEM, logging Jump Hosts Admin access CDE Cardholder Data Environment Payment Servers POS Terminals Card Data DBs Tokenisation Systems PENTEST SCOPE ✓ CDE systems ✓ Connected-to systems ✓ Segmentation controls ✓ Network perimeter ✗ Out-of-scope (if segmented) Firewall / ACLs Firewall / ACLs LEGEND CDE Connected-to Out-of-scope Segmentation boundary

Penalties

Non-compliance with PCI DSS carries financial consequences imposed by the payment card brands (Visa, Mastercard, American Express, etc.) through acquiring banks:

  • Fines ranging from $5,000 to $100,000 per month until compliance is achieved
  • Increased transaction fees from acquiring banks
  • Potential loss of the ability to process card payments

Relationship with Other Frameworks

PCI DSS pentesting requirements overlap with several other regulatory frameworks. Organisations subject to multiple standards can often align testing efforts to satisfy more than one requirement at a time. Related frameworks include NIST CSF 2.0, ISO 27001, SOC 2, and DORA for financial sector entities.

How FORTBRIDGE Can Help

FORTBRIDGE is a CREST-accredited penetration testing provider with senior consultants experienced in PCI DSS compliance testing. We deliver actionable findings across network, application, and cloud environments. Contact us to discuss how we can support your PCI DSS 4.0.1 pentesting requirements.

About Post Author

Bogdan Tiron

Cloud Application Security Consultant/ Pentester

OSCP/CRT/GCP Architecture/GCP Security/DevSecOps

See author's posts