PCI DSS 4.0
Req 11: Test Security Regularly

PCI DSS 4.0 11.4.3: 11.4.3 External penetration testing annually and after change

External penetration testing must be performed: using the methodology the entity has defined; no less than annually; after every significant upgrade or change to infrastructure or applications; by a qualified tester, whether an internal resource or an external third party; and with organizational independence of the tester (a QSA or ASV is not required). Guidance (good practice): when selecting a tester, entities can weigh specialist penetration testing certifications and prior experience such as years in the field and the type and scope of past engagements. Objective under the customized approach: technical testing following the defined methodology verifies external defenses as often as needed to keep pace with new and evolving attacks and to confirm that significant changes bring in no unknown vulnerabilities.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 41 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 4 controls

  • 5.30 ICT readiness for business continuity
  • 5.35 Independent review of information security
  • 8.29 Security testing in development and acceptance
  • 8.8 Management of technical vulnerabilities

FedRAMP High · 3 controls

  • CA-2(1) Independent Assessors
  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))

FedRAMP Moderate · 3 controls

  • CA-2(1) Independent Assessors
  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))

ISO 27001:2022 · 3 controls

  • 5.35 Independent review of information security
  • 8.29 Security testing in development and acceptance
  • 8.8 Management of technical vulnerabilities

CIS Controls v8 · 2 controls

  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-18.2 Perform Periodic External Penetration Tests

CMMC 2.0 · 2 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

NIST SP 800-172 · 2 controls

  • 3.11.5e Assess Effectiveness of Security Solutions
  • 3.12.1e Penetration Testing by Independent Agents

NIST SP 800-53 Rev 5 · 2 controls

  • NIST800-CA-8 CA-8 Penetration Testing
  • SP800-53-CA Assessment, Authorization, and Monitoring Family

NIST SP 800-66 Rev 2 · 2 controls

PCI 3DS Core Security Standard · 2 controls

  • P1-4.2.5 P1-4.2.5 Annual penetration testing
  • P1-4.2.6 P1-4.2.6 Penetration tests by qualified personnel

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

APRA CPS 234 · 1 control

AWS Well-Architected Security Pillar · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Azure Security Benchmark · 1 control

C5 (Germany) · 1 control

  • C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

NIS2 Directive · 1 control

  • Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures

NIST Cybersecurity Framework 2.0 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-53A Rev. 5 · 1 control

  • 53A-D Penetration Testing

SOC 2 · 1 control

  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Req 11: Test Security Regularly

You are reading one control. How much of PCI DSS 4.0 have you already done?

PCI DSS 4.0 11.4.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.

If you hold ISO 27001:202249.6% covered · 141 gapsIf you hold FedRAMP Moderate49.3% covered · 142 gapsIf you hold NIST SP 800-53 Rev 547.5% covered · 147 gapsIf you hold ISO 27002:202243.2% covered · 159 gapsIf you hold CIS Controls v838.2% covered · 173 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.136.4% covered · 178 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 41 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PCI DSS 4.0 controls