Multi-tenant service providers must support their customers in external penetration testing as required by Requirement 11.4.3 (external testing) and Requirement 11.4.4 (remediation). Applicability: applies only when the assessed entity is a multi-tenant service provider. It can be met either by giving customers evidence that penetration testing meeting 11.4.3 (external testing) and 11.4.4 (remediation) was done on their subscribed infrastructure, or by giving each customer prompt access so they can run their own tests. Evidence may be redacted results but must contain enough detail to show every element of the external testing and remediation requirements was satisfied on the customer's behalf. See also Appendix A1. Objective under the customized approach: customers' technical testing needs are met by the multi-tenant provider, either through access or through evidence that equivalent testing was done. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.
This control maps to 17 controls across 7 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
PCI DSS 4.0 11.4.7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.
The graph holds this control, the 17 it maps to, and the evidence behind each claim, over MCP and REST.