Cardholder Data Environment
Systems, networks and applications that store, process or transmit card data, assessed as the core of the regulatory scope.
Penetration testing for PCI DSS compliance
PCI DSS requires periodic testing of the card environment. We deliver the test and the evidence your QSA will ask for.
Penetration testing aligned to the PCI DSS testing requirement (11.3 in v3.2.1, now 11.4 in v4.0), covering the cardholder data environment and a recurring test cycle.
PCI DSS testing requirement CDE scope Annual and post-change cycle
When this matters
A quarterly ASV scan does not replace the required penetration test.
PCI DSS treats vulnerability scanning and penetration testing as distinct controls. The ASV (Approved Scanning Vendor) scan covers the external surface on a quarterly cycle; the penetration test, with its own methodology, has to validate the network and application layers, inside and outside the Cardholder Data Environment (CDE), run annually and after any significant change to the payment infrastructure.
01
Annual certification or SAQ renewal
02
Significant change to the card environment
03
Validating CDE segmentation
04
Acquirer or card brand requirement
Typical scope
What makes up a PCI DSS-aligned penetration test.
The exact composition depends on your PCI DSS level, your card processing model and how the CDE is segmented from the rest of the network.
Segmentation validation
Confirmation that the controls used to reduce CDE scope really do isolate the card environment from the rest of the corporate network.
Network and application layers
Internal and external testing covering network infrastructure as well as the applications that process card transactions.
Annual and change-driven cycle
Recurring execution every 12 months and whenever there is a significant change to CDE topology, applications or controls.
Inside the delivery
See how this work takes shape.
From technical alignment to delivery, the work has to leave context, evidence and next steps visible to everyone involved.
01 / 04
Process
A testing cycle that fits the certification calendar.
The timeline is designed to fit the window between assessment and delivery to the QSA or acquirer.
Confirm the CDE scope
Together with your team we map which systems store, process or transmit card data and where the segmented environment ends.
Network and application testing
We run the required internal and external tests, including segmentation validation when it is used to reduce scope.
Validate critical findings
Exploitable vulnerabilities inside the CDE are prioritized so they can be fixed before the certification cycle closes.
Report for the QSA
We deliver scope, methodology and findings documented in the format assessors and acquirers normally ask for.
Deliverables
Evidence that spans compliance, IT and the payments team.
The report has to hold up both in the conversation with the QSA and in internal technical prioritization.
Evidence for the certification cycle
Scope, methodology and finding status documented in the format assessors and acquirers expect.
Segmentation confirmed
Clarity on whether current controls really isolate the CDE, or whether the compliance scope is larger than assumed.
Remediation prioritized by the CDE
Findings inside the card environment take priority because of their direct impact on regulated data.
Frequently asked questions
Straight answers to help you plan the assessment.
If your question isn't here, talk to the team directly.
Ask on WhatsAppDoes the penetration test alone guarantee PCI DSS certification?+
No. It satisfies one of the standard's technical requirements, but certification also depends on other controls, processes and the full assessment carried out by the QSA or the self-assessment process (SAQ).
Are ASV scans and penetration tests the same thing?+
No. The ASV scan is a quarterly automated sweep of the external surface performed by an approved vendor. The penetration test is a deeper assessment with its own methodology, run at least annually and after significant changes.
Is segmentation testing separate from the penetration test?+
When segmentation is used to reduce CDE scope, PCI DSS requires specific validation that the isolation controls work. That can be part of the same project or a dedicated test.
How often does the test need to be repeated?+
The standard requires it at least once a year and whenever there is a significant change to the infrastructure, applications or controls that make up the card environment.
Next step
Need penetration testing for your PCI DSS certification cycle?
Tell us your PCI DSS level, how the CDE is segmented and the timeline of your assessment cycle.