Lion Cipher Lab
Check two years of penetration tests against the PCI DSS 11.4 cadence
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Payment card rules (PCI DSS) do not just ask for 'a pentest'. Requirement 11.4 asks for a penetration testing PROGRAM: internal and external tests at least once every 12 months and after any significant infrastructure or application change, segmentation tests at least once every 12 months and after segmentation changes, exploitable findings corrected and the test repeated to verify, and test results kept for at least 12 months. Organizations usually pass the 'did we do a pentest this year?' question and fail the program questions: a test slips from November to January and the 12 months…
What you'll learn
- what PCI DSS v4.0 requirement 11.4 asks of a pentest program
- checking the 12-month cadence per test type
- matching significant changes to the tests that should follow them
- catching exploitable findings that were never retested
- the 12-month results-retention rule
- separating PCI's rule from your own policy choices
Steps in this lab
- What 11.4 actually requires
- Two years of tests and changes
- Write the cadence checker
- Run it: seven gaps
- Turn it into a calendar, and stay honest