PCI DSS v4.0.1
PCI DSS is a standard maintained by the PCI Security Standards Council.
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- Standard maintained by the PCI Security Standards Council. Compliance is validated through a QSA Report on Compliance or a Self-Assessment Questionnaire; quarterly external scans must be performed by a PCI SSC Approved Scanning Vendor (ASV). VulnVerify is not an ASV or QSA.
- Summary
- PCI DSS sets explicit frequencies: quarterly internal and external vulnerability scans, annual internal and external penetration tests, segmentation testing, and testing after significant changes (Requirement 11), plus remediation and retest.
- Version
- PCI DSS v4.0.1 (June 2024) — the only active version; all future-dated v4.0 requirements became mandatory on 31 Mar 2025
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| 11.3.1Internal vulnerability scans | Internal vulnerability scans are performed at least once every three months; high-risk and critical vulnerabilities (per the entity's ranking under 6.3.1) are resolved and rescans confirm resolution; performed by qualified personnel with organizational independence of the tester (an ASV is not required for internal scans). | Required | Not named | |
| 11.3.1.1All other applicable vulnerabilities addressed | Vulnerabilities not ranked high-risk or critical are managed per the entity's targeted risk analysis and rescans are conducted as needed. | Required | Not named | |
| 11.3.1.2Authenticated internal scans | Internal vulnerability scans are performed via authenticated scanning, with sufficient privileges and documented exceptions for systems that cannot accept credentials (mandatory since 31 Mar 2025). | Required | Not named | |
| 11.3.1.3Internal scans after significant change | Internal vulnerability scans are performed after any significant change; high-risk and critical vulnerabilities are resolved and rescans confirm it. | Required | Not named | After changes |
| 11.3.2External vulnerability scans (ASV) | External vulnerability scans are performed at least once every three months by a PCI SSC Approved Scanning Vendor, vulnerabilities are resolved and ASV Program Guide requirements for a passing scan are met, with rescans as needed. | Required | Not named | |
| 11.3.2.1External scans after significant change | External vulnerability scans are performed after any significant change, vulnerabilities scored 4.0 or higher by the CVSS are resolved, and rescans are conducted as needed. | Required | Not named | After changes |
| 11.4.1Penetration testing methodology | A penetration-testing methodology is defined, documented and implemented, including industry-accepted approaches, coverage of the entire CDE perimeter and critical systems, testing from inside and outside the network, validation of segmentation and scope-reduction controls, application-layer testing covering at least the vulnerabilities in Requirement 6.2.4, network-layer testing of all components supporting network functions and operating systems, review of threats and vulnerabilities experienced in the last 12 months, a documented approach to the risk of exploitable findings, and retention of results and remediation activities for at least 12 months. | Not named | Required | |
| 11.4.2Internal penetration testing | Internal penetration testing is performed per the methodology at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified internal resource or qualified external third party with organizational independence of the tester. | Not named | Required | After changes |
| 11.4.3External penetration testing | External penetration testing is performed per the methodology at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified internal resource or qualified external third party with organizational independence of the tester. | Not named | Required | After changes |
| 11.4.4Remediation and retest | Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected in accordance with the entity's assessment of the risk, and penetration testing is repeated to verify the corrections. | Not named | Required | |
| 11.4.5Segmentation testing | If segmentation is used to isolate the CDE, penetration tests on segmentation controls are performed at least once every 12 months and after any changes to segmentation controls/methods, covering all segmentation controls and confirming they are operational and effective. | Not named | Required | After changes |
| 11.4.6Segmentation testing — service providers | Service providers only: segmentation penetration testing at least once every six months and after any changes to segmentation controls/methods. | Not named | Required | After changes |
| 11.4.7Multi-tenant service providers support customer penetration testing | Multi-tenant service providers support their customers for external penetration testing per 11.4.3 and 11.4.4. | Not named | Supports | Secondary |
| 6.4.1 / 6.4.2Public-facing web applications protected against attacks | Public-facing web applications are protected either by reviewing them via manual or automated application vulnerability security assessment tools or methods at least once every 12 months and after significant changes (6.4.1), or — required since 31 Mar 2025 and superseding 6.4.1 — by an automated technical solution that continually detects and prevents web-based attacks (6.4.2). | Supports | Supports | Secondary |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- PCI DSS requires scans at least every 3 months under 11.3.1 and 11.3.2. Weekly scans (every 7 days) are supplementary external evidence between ASV scans: the external scan under 11.3.2 must come from an ASV, and we coordinate with an ASV partner for it. The external scan after a significant change under 11.3.2.1 is what the weekly and on-demand scans evidence; the internal scan under 11.3.1 is customer-provided.
- Penetration tests
- PCI DSS requires a penetration test at least every 12 months and after significant changes under 11.4.2, 11.4.3 and 11.4.5.
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- 11.3.2.1 On-demand scan after a significant change, with the change note recorded. 11.3.2.1 does not name an ASV, so VulnVerify's external scan can serve as this evidence; the quarterly scan under 11.3.2 still must come from an ASV.
- 11.4.1 VulnVerify's published methodology statement and statement of work; report structure covering each element.
- 11.4.2 Internal pentest report and retest report (scoped engagement via Contact sales).
- 11.4.3 External pentest report and retest report (scoped engagement via Contact sales).
- 11.4.4 Retest report with before/after evidence.
- 11.4.5 Segmentation test results within the pentest report.
- 11.4.6 Semi-annual segmentation test results.
- 11.4.7 Coordinated testing windows and rules of engagement.
- 6.4.1 / 6.4.2 Application-layer scanning and application pentest results.
What you still need
Customer-provided: 11.3.1, 11.3.1.1, 11.3.1.2 and 11.3.1.3. VulnVerify scans from the outside only.
From an ASV: 11.3.2. The external scan it requires must come from an ASV, and we coordinate with an ASV partner for it.
- 11.3.1 Internal scanning capability where VulnVerify cannot reach; the QSA/SAQ.
- 11.3.2 Quarterly ASV scan from a listed ASV.
Questions about PCI DSS
How often does PCI DSS require scans and penetration tests?
Internal and external vulnerability scans at least every three months (external ones by an ASV), internal and external penetration tests at least every 12 months and after significant changes, segmentation testing at least every 12 months (every six months for service providers).
Is VulnVerify's scan a PCI ASV scan?
No. The quarterly ASV scan must come from an ASV, and we coordinate with an ASV partner for it; VulnVerify's weekly scans cover the time between ASV scans, provide after-change external scan evidence, and support the other Requirement 11 evidence.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- PCI Security Standards Council — PCI DSS v4.0.1 (June 2024), Requirements 6 and 11
- PCI SSC — ASV Program Guide
- PCI SSC — Information Supplement: Penetration Testing Guidance
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.