# PCI DSS v4.0.1: VA, ASV Scans, Pentest and Segmentation Testing

Locale: `en`

Source: `/en/compliance/pci-dss/`

Summary: The security standard for entities that store, process, transmit, or can affect the security of payment card data.

On this page

1. [Overview](/en/compliance/pci-dss/#topic-overview)
2. [Planning testing under PCI DSS v4.0.1](/en/compliance/pci-dss/#compliance-control-summary)
3. [CDE Scope and Governed Entities under PCI DSS v4.0.1](/en/compliance/pci-dss/#pci-scope-architecture)
4. [Internal VA and External ASV Scanning (Requirement 11.3)](/en/compliance/pci-dss/#pci-va-asv-scanning)
5. [Penetration Testing Requirements (Requirement 11.4)](/en/compliance/pci-dss/#pci-pentest-requirements)
6. [Segmentation Verification Testing (Requirements 11.4.5 & 11.4.6)](/en/compliance/pci-dss/#pci-segmentation-testing)
7. [Technical Assurance Matrix: VA vs. ASV vs. Pentest vs. Segmentation](/en/compliance/pci-dss/#pci-comparison-matrix)
8. [Requirements Matrix](/en/compliance/pci-dss/#compliance-matrix)
9. [Readiness Assessment](/en/compliance/pci-dss/#compliance-readiness-checklist)
10. [Frequently Asked Questions](/en/compliance/pci-dss/#compliance-faq)
11. [Related Frameworks](/en/compliance/pci-dss/#related-compliance-frameworks)

# PCI DSS v4.0.1: VA, ASV Scans, Pentest and Segmentation Testing

The security standard for entities that store, process, transmit, or can affect the security of payment card data.

Executive Summary and Mandate Overview

Target Audience

Merchants, Payment Processors, Gateways, and E-commerce handling card data (CDE)

Mandatory Frequency

Quarterly internal VA & external ASV scans (Req 11.3), annual pentest (Req 11.4), and segmentation testing every 6–12 months (Req 11.4.5/11.4.6)

Required Scope

Cardholder Data Environment (CDE), Connected-to Systems, Payment APIs, Network Perimeter

Non-Compliance Risk

Fines or other consequences depend on the applicable payment card brand programme. Confirm the terms with the card brand and acquirer; PCI SSC does not prescribe a common fine schedule.

## Planning testing under PCI DSS v4.0.1

Start with the Cardholder Data Environment, or CDE, and systems that can affect its security rather than only the payment page.

[![PCI DSS 11.4: from CDE scope to remediation evidence: Define methodology, Set scope, Test across dimensions, Apply the cadence, Remediate and retest, Retain evidence](/assets/compliance/guide-pci-dss-compliance-control-summary-en-v1.webp)](/assets/compliance/guide-pci-dss-compliance-control-summary-en-v1.webp)

**PCI DSS 11.4: from CDE scope to remediation evidence**

Requirement 11.4 connects methodology, CDE scope, internal and external testing, remediation, and retest into one evidence trail

- **Define methodology** — Use and document an industry-accepted methodology
- **Set scope** — Cover the CDE perimeter, critical systems, and controls that reduce scope
- **Test across dimensions** — Cover internal, external, application-layer, network-layer, and segmentation testing
- **Apply the cadence** — Test at least every 12 months and after significant infrastructure or application changes
- **Remediate and retest** — Correct issues according to risk and repeat penetration testing to verify the correction
- **Retain evidence** — Retain penetration-test and remediation results for at least 12 months

- Establish data flow diagrams and asset inventories to accurately bound the CDE, connected-to systems, and security-impacting assets.
- Requirement 11.3 mandates quarterly authenticated internal vulnerability scans and quarterly external scans via a certified PCI SSC ASV.
- Requirement 11.4 mandates annual internal and external penetration testing across network and application layers, followed by formal retesting.
- Requirements 11.4.5 and 11.4.6 mandate CDE segmentation verification testing annually for merchants and semi-annually for service providers.

PCI DSS v4.0.1 / CDE SCOPING & GOVERNANCE

## PCI DSS v4.0.1 Standard Architecture and CDE Scoping

PCI DSS v4.0.1 mandates identifying the Cardholder Data Environment (CDE) and all connected or security-impacting systems prior to executing technical security evaluations.

[![CDE boundary diagram showing card data, connected systems, security controls, and isolated systems](/assets/compliance/guide-pci-dss-scope-architecture-th-v1.webp)](/assets/compliance/guide-pci-dss-scope-architecture-th-v1.webp)

**PCI DSS 4.0.1: CDE scoping and related systems**

Accurate scoping underpins assessment; omitting systems connected to the CDE undermines the testing and validation scope

1. **1. Identify card data** — Classify CHD (PAN, expiry, cardholder name) and SAD (CVV, PIN blocks)
2. **2. Cardholder Data Environment (CDE)** — People, processes, servers, and systems that store, process, or transmit card data
3. **3. Connected-to systems** — Systems with direct or indirect network paths into the CDE
4. **4. Security-impacting systems** — Systems affecting CDE security, such as Active Directory, bastion hosts, SIEM, and firewalls
5. **5. Out-of-scope systems** — Systems isolated from the CDE by tested segmentation

- Applicable Entities: Encompasses merchants, acquiring/issuing banks, payment processors, and third-party service providers (TPSPs) storing, processing, or transmitting cardholder data (CHD) or sensitive authentication data (SAD).
- CDE Scoping Definition: Encompasses people, processes, and technology hosting cardholder data, plus connected-to systems and security-impacting infrastructure (e.g., identity directories, bastion hosts, SIEMs, firewalls).
- Compliance Validation Tracks: Governed by annual transaction volume tiers (Levels 1 to 4), spanning Self-Assessment Questionnaires (SAQ A, A-EP, B, C, D) to on-site Qualified Security Assessor audits (Report on Compliance: ROC).
- Full Enforcement of v4.0.1 Mandates: Future-dated mandates, including authenticated internal scanning (11.3.1.2), targeted risk analysis (11.3.1.1), and multi-tenant test support (11.4.7), became fully enforceable on March 31, 2025.

**Technical and audit perspective**

Accurate data flow diagrams and real-time asset inventories are non-negotiable prerequisites; omitting connected systems invalidates testing scope during QSA audits.

PCI DSS REQ 11.3 / VULNERABILITY ASSESSMENTS & ASV

## Internal Vulnerability Assessments and External ASV Scanning (Requirement 11.3)

Requirement 11.3 mandates identifying, prioritizing, and addressing security vulnerabilities through two distinct technical workflows: internal scanning and external ASV scans.

[![Parallel internal authenticated and external ASV scan tracks leading to four quarterly passing reports](/assets/compliance/guide-pci-dss-va-asv-scanning-th-v1.webp)](/assets/compliance/guide-pci-dss-va-asv-scanning-th-v1.webp)

**PCI DSS 11.3: Internal vulnerability and external ASV scans**

Internal VA requires authenticated scanning; quarterly external scans require official reports from a PCI SSC Approved Scanning Vendor

1. **1. Authenticated internal scan (11.3.1.2)** — Scan quarterly with credentials sufficient to inspect OS and configuration weaknesses
2. **2. Remediate High / Critical findings** — Apply Requirement 6.3.1 and manage lower risks under targeted risk analysis (11.3.1.1)
3. **3. Rescan to verify closure** — Repeat scans within the required timeframe to confirm remediation
4. **4. External ASV scan (11.3.2)** — Have a PCI SSC Approved Scanning Vendor scan Internet-facing systems quarterly
5. **5. Quarterly passing scans** — Obtain four passing reports per year with no CVSS ≥ 4.0 findings or automatic failures

- Internal Vulnerability Scanning (Req 11.3.1): Mandatory quarterly scans (every 3 months) of all internal CDE components; all High and Critical vulnerabilities (per Req 6.3.1) must be remediated with rescans verifying resolution.
- Authenticated Scanning Requirement (Req 11.3.1.2): Internal scans must utilize authenticated credentials with sufficient privileges to inspect internal OS packages and configurations; systems unable to accept credentials must be documented.
- Managing Lower-Risk Vulnerabilities (Req 11.3.1.1): Vulnerabilities below High/Critical must be prioritized and remediated in accordance with defined Targeted Risk Analysis (TRA per Req 12.3.1) timelines.
- External ASV Scanning (Req 11.3.2): All external, Internet-facing IP addresses and domains within or connected to the CDE must be scanned quarterly by a certified PCI SSC Approved Scanning Vendor (ASV).
- ASV Passing Scan Standard: Passing results require zero vulnerabilities with a CVSS score of 4.0 or higher and zero automatic-failure items (e.g. SQLi, XSS, directory traversal, unsupported software); clean passing reports must be secured across all four quarters.
- Post-Change Vulnerability Scanning (Req 11.3.1.3 & 11.3.2.1): Both internal and external scans must be executed following significant infrastructure, firewall, or application changes.

**Technical and audit perspective**

Internal VA may be conducted by qualified internal personnel with organizational independence or third-party contractors, whereas external scans under Req 11.3.2 legally require a certified PCI SSC Approved Scanning Vendor (ASV).

PCI DSS REQ 11.4 / PENETRATION TESTING

## Penetration Testing Requirements (Requirement 11.4)

Requirement 11.4 mandates adversarial penetration testing to simulate real attacks, demonstrate exploitability, and confirm that CDE defense-in-depth controls resist breach.

[![Five-step CDE penetration testing loop from methodology and tests to remediation, retest, and evidence](/assets/compliance/guide-pci-dss-pentest-requirements-th-v1.webp)](/assets/compliance/guide-pci-dss-pentest-requirements-th-v1.webp)

**PCI DSS 11.4: CDE penetration testing lifecycle**

Organizationally independent testers must retest exploitable findings after remediation before finalizing the report

1. **1. Methodology and use cases (11.4.1)** — Use industry methods (NIST/OWASP/PTES) and the preceding 12 months of threat history
2. **2. External and internal tests (11.4.2 & 11.4.3)** — Test the perimeter and internal paths into the CDE at least annually
3. **3. Network and application coverage** — Test network infrastructure and payment web applications or APIs against Requirement 6.2.4
4. **4. Remediation and retesting (11.4.4)** — Fix exploitable weaknesses and repeat penetration testing to verify closure
5. **5. Retain evidence for 12 months** — Keep reports, remediation details, and retest evidence for QSA review

- Documented Industry Methodology (Req 11.4.1): Testing must follow recognized methodologies (NIST SP 800-115, OWASP WSTG, PTES), covering the entire CDE perimeter and critical assets.
- Internal and External Cadence (Req 11.4.2 & 11.4.3): Executed at least once every 12 months and after any significant system change, covering external public attack surfaces and internal network paths into the CDE.
- Dual Network and Application Layers: Assesses both network-layer infrastructure (firewalls, routers, OS hardening) and payment web/API application logic against Requirement 6.2.4 vulnerability categories.
- 12-Month Threat History Integration: Testing procedures must incorporate threat intelligence and vulnerabilities observed across the organization over the preceding 12 months.
- Exploit Remediation and Mandatory Retest (Req 11.4.4): Exploitable weaknesses must be remediated in accordance with risk rankings, followed by retesting to verify effective closure.
- Evidence Retention (Req 11.4.1): Full penetration test reports, remediation logs, and retest evidence must be retained for at least 12 months for QSA audit verification.
- Multi-Tenant Provider Support (Req 11.4.7): Multi-tenant providers must support customer-requested external penetration testing obligations (mandatory since March 31, 2025).

**Technical and audit perspective**

Testers must be organizationally independent of network admins and developers; holding recognized certifications such as OSCP, GPEN, or CREST validates competent execution.

PCI DSS REQ 11.4.5 / 11.4.6 / SEGMENTATION VERIFICATION

## CDE Segmentation Verification Testing (Requirements 11.4.5 & 11.4.6)

When network segmentation isolates the CDE to reduce compliance scope, penetration testing must empirically verify that out-of-scope networks cannot reach CDE systems.

[![Packet probes from out-of-scope networks blocked at the CDE firewall, with merchant and provider test intervals](/assets/compliance/guide-pci-dss-segmentation-testing-th-v1.webp)](/assets/compliance/guide-pci-dss-segmentation-testing-th-v1.webp)

**PCI DSS 11.4.5/11.4.6: CDE segmentation verification**

Verify segmentation with live probes from outside the CDE boundary rather than relying solely on diagrams or firewall rules

1. **1. Identify every segmentation control** — Check firewalls, router ACLs, VLANs, and microsegmentation between out-of-scope networks and the CDE
2. **2. Probe from outside the CDE** — Send port scans and packet probes from corporate LAN, Wi-Fi, and development networks toward the CDE
3. **3. Verify blocked unauthorized paths** — Confirm that no unauthorized port or route permits access to the CDE
4. **4. Test at the entity-specific frequency** — Merchants test at least every 12 months; service providers at least every 6 months
5. **5. Handle segmentation failure** — A reachable system may enter PCI DSS scope; correct controls and retest

- Active Probing Methodology: Testers execute port scans and packet probes from out-of-scope network segments (corporate LANs, branch offices, guest Wi-Fi, dev tiers) directed at CDE endpoints to prove complete isolation.
- Comprehensive Control Evaluation: Tests all deployed segmentation mechanisms, including perimeter/internal firewalls, router ACLs, VLAN segmentation, microsegmentation policies, and hypervisor boundaries.
- Merchant Frequency Mandate (Req 11.4.5): Validated at least once every 12 months (annually) and after any modifications to segmentation controls or network architectures.
- Service Provider Semi-Annual Cadence (Req 11.4.6): Service providers must test segmentation controls at least once every six (6) months and after any changes to segmentation controls.
- Isolation of Differing Security Levels (Req 2.2.3): Validates that systems with disparate trust levels are separated to prevent lateral movement and privilege escalation into the CDE.
- Consequences of Segmentation Failure: Any out-of-scope asset found capable of reaching the CDE immediately expands the CDE scope, requiring remediation and re-testing before compliance can be attested.

**Technical and audit perspective**

Segmentation testing requires live network probing from out-of-scope subnets, not a passive desk audit of firewall access-control lists.

PCI DSS REQ 11 / TECHNICAL ASSURANCE TAXONOMY

## Technical Assurance Matrix: VA vs. ASV Scans vs. Pentest vs. Segmentation Testing

Requirement 11 establishes four distinct security testing activities with distinct objectives, scopes, frequencies, and tester qualification mandates.

| Assessment Type | PCI DSS Ref | Target Scope | Frequency | Assessor Mandate | Passing Criteria |
| --- | --- | --- | --- | --- | --- |
| **Internal Vulnerability Assessment (VA)** | Requirement 11.3.1 / 11.3.1.2 | All internal system components and networks within CDE scope | At least once every 3 months and after significant changes | Qualified independent internal staff or external firm (ASV/QSA not required) | Remediate all High and Critical flaws with confirming rescans; authenticated scanning mandated under Req 11.3.1.2 |
| **External Vulnerability Scanning (ASV Scan)** | Requirement 11.3.2 / 11.3.2.1 | External Internet-facing IPs and domains in or connected to CDE | At least once every 3 months and after significant changes | Certified PCI SSC Approved Scanning Vendor (ASV) only | Zero CVSS ≥ 4.0 vulnerabilities and zero auto-fails; passing reports secured across all 4 quarters |
| **Penetration Testing (Internal & External)** | Requirement 11.4.1 – 11.4.4 | CDE perimeter, critical infrastructure, network layer, and application layer | At least once every 12 months and after significant changes | Qualified tester with organizational independence (certifications such as OSCP, GPEN, CREST recommended) | Remediate all exploitable vulnerabilities and perform mandatory retests confirming effective closure |
| **CDE Segmentation Verification Testing** | Requirement 11.4.5 & 11.4.6 | All isolation controls (firewalls, ACLs, VLANs, microsegmentation) isolating non-CDE from CDE | Merchants: Annually \| Service Providers: Semi-annually; and after isolation changes | Qualified tester with organizational independence (ASV/QSA not required) | Active packet probing and port scans confirm zero unauthorized routes into CDE assets |

**Technical and audit perspective**

QSAs evaluate all four activities independently; ASV scans cannot substitute for penetration testing, nor can general pentest reports replace dedicated segmentation verification testing.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **Requirement 11.3.1** | Internal Vulnerability Scanning (Authenticated Scan) | All internal components within CDE scope | At least once every 3 months (quarterly) and after significant changes |
| **Requirement 11.3.2** | External Vulnerability Scanning (ASV Scan) | External Internet-facing IPs and domains in CDE scope | At least once every 3 months (quarterly) by a PCI SSC Approved Scanning Vendor |
| **Requirement 11.4.2 & 11.4.3** | External & Internal Penetration Testing | CDE perimeter, critical systems, network layer, and application layer | At least once every 12 months (annually) and after significant changes |
| **Requirement 11.4.4** | Remediation and Retesting of Exploitable Flaws | Exploitable vulnerabilities identified during penetration testing | Remediate according to risk ranking and retest to confirm closure |
| **Requirement 11.4.5** | CDE Segmentation Verification Testing (Merchants) | Network isolation between out-of-scope systems and CDE | At least once every 12 months and after isolation changes |
| **Requirement 11.4.6** | CDE Segmentation Verification Testing (Service Providers) | Network isolation and firewall controls for service providers | At least every 6 months and after isolation changes |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

External Vulnerability Scanning performed quarterly by a PCI SSC Approved Scanning Vendor (ASV) with passing scan reports (Req 11.3.2)
          
          
            
            Internal Vulnerability Scanning performed quarterly using authenticated scans, resolving High/Critical flaws with rescans (Req 11.3.1)
          
          
            
            External Penetration Testing conducted for CDE perimeter at least annually and after significant changes (Req 11.4.3)
          
          
            
            Internal Penetration Testing performed inside the network toward CDE at least annually and after significant changes (Req 11.4.2)
          
          
            
            CDE Segmentation Verification Testing executed annually (and every 6 months for service providers) under Req 11.4.5/11.4.6
          
          
            
            All exploitable vulnerabilities remediated and validated via retesting, with evidence retained for at least 12 months (Req 11.4.4)

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### What does PCI DSS v4.0.1 Requirement 11.4 mandate for penetration testing?

Requirement 11.4 mandates annual internal and external penetration testing, as well as testing after any significant infrastructure or application modification. It covers both network and application layers, requiring remediation of exploitable findings and mandatory retesting.

### What are the authenticated scanning mandates for internal vulnerability assessments under Requirement 11.3.1?

Requirement 11.3.1.2 under PCI DSS v4.0.1 (fully enforceable since March 31, 2025) requires internal vulnerability scans to be performed using authenticated credentials with sufficient privileges to inspect local OS and installed packages, executed at least once every 3 months.

### What is an ASV Scan under Requirement 11.3.2, and what constitutes a passing scan?

An ASV scan is an external vulnerability scan performed quarterly by a certified PCI SSC Approved Scanning Vendor. A passing scan requires zero vulnerabilities with a CVSS score of 4.0 or higher and zero automatic-failure vulnerabilities (such as SQL injection or unsupported software).

### How often must CDE Segmentation Testing be performed under Requirements 11.4.5 and 11.4.6?

Requirement 11.4.5 requires merchants using segmentation to validate isolation controls at least annually and after isolation changes. Requirement 11.4.6 mandates that service providers test segmentation controls at least every 6 months and after isolation changes to maintain scope reduction.

### What is the operational difference between VA, ASV Scans, and Penetration Testing?

Vulnerability Assessments and ASV Scans (Req 11.3) are automated quarterly scans checking for known CVEs. Penetration Testing (Req 11.4) is a manual adversarial simulation conducted annually to exploit flaws and breach defenses. Segmentation testing validates that out-of-scope networks cannot reach CDE assets.

## Related Compliance Frameworks and Security Standards

- [
                Bank of Thailand pentest rules for financial institutions
                
              ](/en/compliance/bank-of-thailand/)
- [
                Does ISO/IEC 27001:2022 require penetration testing?
                
              ](/en/compliance/iso-27001/)
- [
                Does Thailand's PDPA require penetration testing?
                
              ](/en/compliance/pdpa/)
- [
                NDID member penetration testing requirements
                
              ](/en/compliance/ndid/)

Open full-size image to zoom

## Official source documents

Download the official PCI DSS document from the PCI SSC library.

[Go to the official source ](https://www.pcisecuritystandards.org/document_library/)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 16 October 2026