Understanding the PCI DSS v4.0.1 Standard
The Payment Card Industry Data Security Standard (PCI DSS) is a globally mandated security standard governed by the PCI Security Standards Council (PCI SSC) and enforced by major card brands (Visa, Mastercard, American Express, Discover, and JCB). Organizations that store, process, or transmit Cardholder Data (CHD) or Sensitive Authentication Data (SAD)—or that could impact the security of the Cardholder Data Environment (CDE)—must validate compliance annually.
With the mandatory retirement of PCI DSS v3.2.1, PCI DSS v4.0.1 represents the governing standard. Version 4.0.1 significantly elevates technical rigor, with explicit, non-negotiable mandates centered under Requirement 11: Regularly Test Security Systems and Networks.
To achieve and maintain compliance, entities must establish a disciplined cadence spanning both recurring vulnerability scanning (Req 11.3) and hands-on penetration testing (Req 11.4).
Requirement 11.3: Mandatory Vulnerability Scanning Cadence
PCI DSS Requirement 11.3 requires organizations to run systematic vulnerability scans to detect, prioritize, and remediate technical vulnerabilities across both internal and external assets.
1. Internal Vulnerability Scanning (Req 11.3.1)
- Frequency: Must be performed at least once every three months (quarterly), as well as after any significant infrastructure or application upgrade.
- Passing Threshold: Organizations must resolve all vulnerabilities categorized as “High” (or scoring 4.0 or above in CVSS metrics) according to the entity’s defined vulnerability risk ranking.
- Rescan Requirement: Rescans must be conducted to verify that identified vulnerabilities were successfully remediated.
2. External Vulnerability Scanning (Req 11.3.2)
- Frequency: Must be performed at least once every 90 days across all internet-facing IP addresses and perimeter domains associated with the CDE.
- Execution Mandate: External scans must be executed by a certified PCI SSC Approved Scanning Vendor (ASV).
- Passing Threshold: A passing ASV scan report requires that no vulnerability with a CVSS score of 4.0 or higher (or specific automated fail conditions) remains unresolved.
Requirement 11.4: Mandatory Penetration Testing Program
While vulnerability scanning is automated, penetration testing (Req 11.4) requires an independent, qualified offensive security specialist to actively exploit vulnerabilities and simulate real-world attacks against your environment.
| Requirement | Focus Area | Mandatory Cadence | Key Technical Standard |
|---|---|---|---|
| 11.4.1 | Methodology Definition | Ongoing | Documented methodology based on NIST SP 800-115, PTES, or OWASP |
| 11.4.2 | External Penetration Testing | At least once every 12 months | Entire external perimeter, payment portals, and external routing appliances |
| 11.4.3 | Internal Penetration Testing | At least once every 12 months | Internal CDE network, Active Directory, server infrastructure, and workstations |
| 11.4.4 | Vulnerability Exploitation | During every assessment | Operator must attempt manual exploitation to prove depth of risk |
| 11.4.5 / 11.4.6 | Segmentation Validation | Every 12 mos (Merchants) / Every 6 mos (Service Providers) | Testing isolation between CDE and corporate out-of-scope networks |
The Crucial Distinction: ASV Scanning vs. Penetration Testing
A common compliance violation cited by Qualified Security Assessors (QSAs) is confusing an automated scanner export with a penetration test. PCI DSS explicitly states that an automated scanner export does not constitute a penetration test.
Penetration testing requires human ingenuity: chaining low-severity misconfigurations together, crafting custom exploits, testing web application business logic, and attempting lateral privilege escalation.
Network Segmentation Validation: Cutting Your Audit Scope
One of the most cost-effective strategies for PCI compliance is network segmentation. By placing your payment processing infrastructure inside an isolated VLAN or cloud VPC (the CDE) and strictly walling it off from the broader corporate network, you drastically reduce the number of systems subject to annual audit.
However, under Requirement 11.4.5 (Merchants) and Requirement 11.4.6 (Service Providers), you must prove to your QSA that your segmentation controls are mathematically impermeable:
- The Test: A penetration tester must simulate an attacker who has compromised a standard corporate workstation, Wi-Fi network, or development environment and attempt to breach the CDE boundary.
- Techniques Evaluated: Testing for routing table misconfigurations, firewall rule bypasses, cross-VLAN broadcast protocols, shared Active Directory administrative credentials, and unauthorized outbound connectivity from within the CDE.
- Frequency for Service Providers: Third-party service providers must perform segmentation validation testing at least once every six months and after any change to segmentation controls.
What Qualified Security Assessors (QSAs) Demand in Your Report
To achieve a clean Report on Compliance (ROC) or Attestation of Compliance (AOC), your QSA will audit the following penetration test deliverables:
- Documented Scope Alignment: Confirmation that all systems in the CDE, all systems connecting to the CDE, and all critical perimeter assets were included in the assessment scope.
- Evidence of Manual Exploitation: Detailed technical logs, traffic captures, and reproducible proof-of-concept steps proving that testing went beyond superficial port scanning.
- Formal Verification Retest: Documented retesting verifying that all identified Critical and High findings were patched and validated by the tester.
- Independent Assessor Qualifications: Proof that testing was conducted by qualified offensive specialists with verified industry credentials (such as OSEP, OSCP, BSCP, or CRTO).
Relevance to Canadian Merchants, Acquirers & Payment Providers
In Canada, PCI DSS compliance is governed by the PCI Security Standards Council and enforced directly through Canadian financial institutions and payment acquirers:
- Canadian Acquiring Bank Mandates: Major Canadian merchant acquirers—including Moneris Solutions, TD Merchant Solutions, RBC Merchant Services, Chase Paymentech Canada, Elavon Canada, and Global Payments—mandate annual Attestations of Compliance (AOC) and third-party penetration testing reports for Level 1 and Level 2 merchants and service providers. Failure to submit compliant assessment deliverables results in escalating monthly non-compliance fines, mandatory QSA on-site audits, or termination of merchant processing privileges.
- Interac, Point-of-Sale (POS) & E-Commerce Integration: Canadian retailers, hospitality operators, and e-commerce platforms handling card-present Interac Flash/chip transactions alongside online payment gateways must validate network segmentation. Testing isolation between point-of-sale terminals, corporate office networks, and cloud e-commerce databases is essential to limit CDE audit scope and eliminate cross-environment compromise.
- Canadian Fintechs & Payment Facilitators (PayFacs): Growing Canadian fintech startups embedding payment APIs or operating multi-tenant transaction platforms must prove CDE segmentation and API security to partner with Canadian Schedule I banks.
How Riptide Cybersecurity Delivers PCI DSS Assurance
Riptide Cybersecurity provides certified, end-to-end technical execution designed specifically to satisfy QSAs, acquiring banks, and merchant compliance teams:
- Adversary External Penetration Testing: Our External Network Penetration Testing service fulfills Requirement 11.4.2, rigorously evaluating perimeter firewalls, VPN endpoints, and web applications.
- CDE Segmentation & Assume-Breach Testing: Our Internal Network & Assume-Breach Assessment satisfies Requirement 11.4.3 and 11.4.5/11.4.6, delivering the definitive proof of segmentation isolation your QSA requires.
- Human-Verified Compliance Scanning: Our Regulatory Compliance Scanning program fulfills Requirement 11.3 on a systematic quarterly cadence. We manually verify scan findings to filter out false positives and deliver audit-ready delta reports.
- Complimentary 90-Day Retesting: Every penetration test includes complimentary verification retesting for Critical and High findings, accompanied by a signed Penetration Test Attestation letter.
Recommended Next Steps
- Review our External Network Penetration Testing Specifications.
- Review our Internal Network & Assume-Breach Specifications.
- Review our Regulatory Compliance Scanning Cadence.
- Request a Scoping Consultation to discuss your CDE boundaries and secure your assessment dates.
