Where segmentation is in use, PCI DSS scope must be confirmed by: following the entity's methodology defined in Requirement 11.4.1; pen-testing the segmentation controls every six months at a minimum and after any change to segmentation controls or methods; testing covering all segmentation controls and methods in use; and testing showing the controls are operational and effective and keep every out-of-scope system separated from the CDE. PCI DSS reference: Requirement 11. Guidance: base PCI DSS normally expects segmentation pen-testing every twelve months, and testing as often as possible is encouraged. Applies only to designated entities. Customized approach objective: not eligible for the customized approach; only the defined approach can be used.
PCI DSS 4.0 A3.2.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.