Schellman becomes The First ISO 42001 ANAB Accredited Certification Body!

Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

PCI DSS & Penetration Testing FAQ

Payment Card Assessments | Penetration Testing

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to protect cardholder data. One of the key (and almost always applicable) requirements of PCI DSS is that organizations must perform internal and external penetration testing for the entire scoped environment—this not only applies to systems that store, process, or transmit cardholder data, but also those that can impact the security of cardholder data.

Although that may seem fairly straightforward, having been performing both PCI DSS assessments and penetration tests for years, we’re still often asked the same questions by organizations of all shapes and sizes. So, to make this aspect of PCI DSS compliance clearer, we’ve put together a collection of frequently asked questions (and answers).

They are categorized around the following two topics:

PCI DSS Penetration Testing Basics

Does Every Organization Undergoing PCI DSS Need to Have a Penetration Test Performed?

Most do, and the PCI Security Standards Council (PCI SSC) has created a set of Self-Assessment Questionnaires (SAQs) that you can use to determine your PCI DSS scope and compliance requirements:

SAQ Type

Penetration Test Required?

SAQ A

No

SAQ B

No

SAQ B-IP

No

SAQ C-VT

No

P2PE

No

SAQ C

Yes

SAQ D

Yes

 

Did PCI DSS v4.0 Change Anything Regarding the Penetration Testing Requirements?

Yes, it did—in PCI DSS v4.0 Req. 11.4.1 and 11.4.4, the updated standard now includes "security weaknesses" as requiring remediation along with exploitable vulnerabilities.

The term “security weaknesses” encompasses all types of vulnerabilities, regardless of their exploitability or severity, and for these non-exploitable findings, the new PCI Requirement 6.3.1 mandates that the organization being assessed review them and evaluate the risk, including potential reclassification (i.e., changing to a false positive).

PCI DSS v4.0 penetration testing requirements become mandatory on March 31, 2025; however, these requirements are also applied during any PCI DSS v4.0 assessment conducted prior. 

 

Do You Have to Remediate All Findings Identified (or Just the High-Risk Ones)?

As we just mentioned, though PCI DSS v3.2.1 only required remediation for exploitable vulnerabilities—or vulnerabilities indicating a PCI DSS requirement is not being met—PCI DSS v4.0 includes both exploitable findings and security weaknesses (i.e., having encryption issues, security misconfigurations, etc.) as issues requiring remediation.

Even so, the timeframe to address findings is not static. A complete and clean—meaning, no open findings—penetration test report is required for a compliant PCI DSS validation. Speak with your penetration tester and QSA to address any timeframe concerns.

 

How Often Does a Penetration Test Need to Be Performed to Maintain PCI DSS Compliance?

You must perform a penetration test at least annually, no matter if you’re a merchant or service provider and if there have been any significant changes to your systems or environment.

 

What’s In-Scope for a PCI DSS Penetration Test?

The following should be in scope for your PCI DSS penetration test:

All external attack surfaces

Examples include:

  • VPN endpoints
  • Public-facing web applications
  • APIs
  • Reporting servers

All internal networks

(Both the cardholder data environment (CDE) network(s) and in-scope non-CDE(s))

Including:

  • Workstations
  • Servers
  • Internal web applications
  • Authentication management
  • Databases

Network segmentation*

The controls should be tested:

  • For Merchants: At least annually
  • For Service Providers: At least every six months

* Network segmentation testing only applies when segmentation controls are in use.

Network Segmentation Questions

Is Network Segmentation Testing Always Required?

Network segmentation is not a requirement but can be used by either merchants or service providers to reduce scope.

If segmentation is not employed, then the entire routable network is in scope (as noted above, and this applies to both merchants and service providers).

 

What Would Be Considered Failing a Network Segmentation Test?

You will fail a network segmentation test upon the discovery of the following:

  • Undefined, unauthenticated, or unprotected services (i.e., weak protocols, weak cryptographic hashes, or not using encryption) having access to the CDE.
  • Networks considered “untrusted” having access to the CDE.

It is important to note that access to the CDE from non-CDE networks is not an automatic fail. Access into the CDE must be defined and assessed as a part of the PCI DSS assessment as a non-CDE in-scope function.

Who Should Perform Your PCI DSS-Required Pen Test and Scans?

Can Your In-House Security Team Perform the Penetration Test?

Yes, you can perform your own penetration test and segmentation tests as long as the personnel performing the test is qualified to do so, meaning:

  • They have organizational independence from the systems being tested (as is stated in the DSS, “...individuals performing assessments are organizationally separate from the management of the environment being assessed of your organization.”)

If that’s not the case, a qualified external third party like Schellman must perform the test.

 

Why Should You Use Schellman for Your PCI DSS Penetration Test?

Between our penetration testers and our PCI QSAs, we are uniquely qualified to assist you with the entirety of your PCI DSS compliance. Though our personnel are organizationally separate to prevent influence, both understand the security controls and threat vectors. If you choose to partner with us, you can expect:

 

  • Extensive Experience: Our QSAs have experience with all the different PCI standards, while our penetration testers are also highly qualified.
  • A More Streamlined Experience: When you choose us to perform both, our staff can coordinate to confirm the scope of the DSS assessment aligns with penetration testing, removing many last-minute headaches.
  • Constant Communication: There will be no waiting to figure out how many findings will be on the final report—our staff will provide updates via AuditSource as vulnerabilities are identified.
  • An Included Retest: We include a single retest of all originally identified findings within 30 days, along with a separate retest report deliverable, and customer-facing attestation letter.

 

How Does Schellman Perform Network Segmentation Testing?

When we test your network segmentation, we’ll first provide a virtual machine (VM) or physical device for you to connect to an “untrusted network”—preferably a corporate network. From there, we will review the CDE and non-CDE in-scope networks and attempt to verify network segmentation controls (through host discovery and TCP/UDP port scanning).

This test typically takes a week, including report writing time.

 

About the Experts:

Perella_Adam_003-1Adam "Sully" Perella is a Technical Director who leads the PIN and P2PE service lines for Schellman. After first getting into the payments space, Sully ramped up to validate payment applications, point-to-point encryption, perform penetration testing, and forensic services. He maintains multiple certifications in information security and payments. Active within the payments community, he helps draft new payment standards and speaks globally on payment security. His current focus includes the Software Security Framework, 3-Domain Secure services (3DS), and external vulnerability scans as an Approved Scanning Vendor (ASV).

 

1136Josh Tomkiel is a Managing Director on Schellman’s Penetration Testing Team based in the Greater Philadelphia area with over a decade of experience within the Information Security field. He has a deep background in all facets of penetration testing and works closely with all of Schellman's service lines to ensure that any penetration testing requirements are met. Having been a penetration tester himself, he knows what it takes to have a successful assessment, including the importance of a positive client experience which Josh takes great care to deliver.

About Schellman

Schellman is a leading provider of attestation and compliance services. We are the only company in the world that is a CPA firm, a globally licensed PCI Qualified Security Assessor, an ISO Certification Body, HITRUST CSF Assessor, a FedRAMP 3PAO, and most recently, an APEC Accountability Agent. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Our approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives through a single third-party assessor.