PCI-DSS Penetration Testing Requirements for SMBs 2025

If your business accepts, processes, or stores payment card data, understanding PCI-DSS penetration testing requirements isn't optional — it's a core obligation that directly affects your compliance standing and your customers' financial security. For small and mid-sized businesses (SMBs), navigating these requirements can feel overwhelming, especially as the Payment Card Industry Data Security Standard evolves with its latest version, PCI-DSS v4.0. This guide breaks down exactly what's required, what's changed, and how SMBs can meet these obligations efficiently in 2025.

What Are PCI-DSS Penetration Testing Requirements?

Penetration testing under PCI-DSS is a structured, simulated cyberattack conducted against your cardholder data environment (CDE) to identify exploitable vulnerabilities before real attackers do. Unlike vulnerability scanning — which is automated and surface-level — penetration testing involves skilled testers actively attempting to breach your systems using the same techniques a malicious actor would employ.

The PCI Security Standards Council mandates penetration testing under Requirement 11.4 of PCI-DSS v4.0. The core obligations include:

• Annual external penetration testing of all systems and networks accessible from the internet that interact with the CDE.
• Annual internal penetration testing targeting the internal network and systems within the CDE boundary.
• Segmentation testing at least every six months (or annually for service providers) to verify that network segmentation controls are effective and that out-of-scope systems cannot reach the CDE.
• Remediation and re-testing — any exploitable vulnerabilities discovered must be corrected, and the test must be repeated to confirm the fix is effective.

It's important to understand that these aren't checkbox exercises. PCI-DSS v4.0 places greater emphasis on the methodology and documentation of penetration tests, requiring organizations to define a comprehensive testing approach that covers the entire attack surface of the CDE.

PCI-DSS v4.0 Changes That SMBs Must Know in 2025

PCI-DSS v4.0 became the only active standard as of March 31, 2024, replacing v3.2.1. Several updates directly affect how penetration testing must be conducted and documented. SMBs that haven't yet updated their compliance programs to reflect v4.0 are already operating against an outdated framework.

Defined Penetration Testing Methodology

Under v4.0, organizations must now maintain a documented penetration testing methodology. This isn't just a report from a third-party tester — it's an internal policy that defines scope, testing techniques, acceptable tools, and how results are reviewed and acted upon. For SMBs without a dedicated security team, this is often the most challenging new requirement to satisfy.

Application-Layer Testing Is Mandatory

PCI-DSS v4.0 explicitly requires that penetration testing cover application-layer vulnerabilities, including those listed in the OWASP Top 10. If your business uses a web application to process payments — even a third-party hosted checkout — the application layer must be in scope for testing. This is a significant expansion for SMBs that previously focused only on network-layer assessments.

Stronger Segmentation Validation

If your organization uses network segmentation to reduce the scope of your CDE (a common and recommended strategy for SMBs), v4.0 requires that segmentation controls be tested by a qualified internal resource or qualified external penetration tester. The test must confirm that segmentation is operational and effective — not just that it exists on paper.

Roles and Qualifications of Testers

PCI-DSS v4.0 requires that penetration testing be performed by a qualified internal resource or qualified external third party. Organizational independence is required — meaning the person conducting the test cannot be responsible for managing the systems being tested. For most SMBs, this means engaging a qualified external penetration testing firm.

Understanding Scope: What Must Be Tested?

One of the most consequential decisions in PCI-DSS compliance is defining the scope of your cardholder data environment. The broader your CDE, the more systems fall under penetration testing requirements. SMBs should work to minimize scope through segmentation, tokenization, and point-to-point encryption (P2PE) solutions.

At minimum, the following must be included in your penetration testing scope:

• All systems that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD)
• All systems that provide security services to the CDE (e.g., authentication servers, log management systems)
• All network components connecting in-scope systems, including firewalls, routers, and switches
• All web-facing applications that interact with the CDE
• Any segmentation controls used to isolate the CDE from out-of-scope networks

A common mistake SMBs make is assuming that using a third-party payment processor removes all testing obligations. While outsourcing payment processing can dramatically reduce scope, it does not eliminate it entirely — especially if your systems pass cardholder data even momentarily before it reaches the processor.

Internal vs. External Penetration Testing: Key Differences

Aspect	External Penetration Test	Internal Penetration Test
Perspective	Simulates an outside attacker targeting internet-facing systems	Simulates an insider threat or attacker who has breached the perimeter
Scope	Public IPs, web applications, external APIs, DNS infrastructure	Internal network, servers, workstations, lateral movement paths
Frequency	At least annually, and after significant infrastructure changes	At least annually, and after significant infrastructure changes
Common Findings	Exposed services, unpatched web apps, misconfigured cloud assets	Privilege escalation paths, weak internal credentials, unencrypted data stores

Both test types are required under PCI-DSS, and both must be documented with findings, risk ratings, remediation steps, and evidence of re-testing. Maintaining this documentation in an organized, audit-ready format is critical when your Qualified Security Assessor (QSA) or Self-Assessment Questionnaire (SAQ) review comes around.

Choosing a Qualified Penetration Testing Provider

Not every penetration testing firm is equipped to meet PCI-DSS requirements. When evaluating vendors, SMBs should look for the following qualifications:

• CREST or GIAC certifications — Look for testers holding credentials such as OSCP, GPEN, GWAPT, or CREST CRT, which demonstrate hands-on technical competency.
• PCI-DSS experience — Ask specifically whether the firm has conducted PCI-scoped penetration tests and whether they understand CDE scoping requirements.
• Methodology documentation — A reputable firm will provide a written methodology aligned with industry frameworks such as NIST SP 800-115 or PTES (Penetration Testing Execution Standard).
• Deliverable quality — The final report should include an executive summary, technical findings with CVSS scores, proof-of-concept evidence, and actionable remediation guidance.

Costs for qualified external penetration testing typically range from $3,000 to $15,000+ for SMBs, depending on scope complexity. While this is a meaningful investment, it is far less costly than a data breach or the fines associated with non-compliance.

How to Prepare Your SMB for a PCI-DSS Penetration Test

1. Define and Document Your CDE Scope

Before engaging a tester, produce a current network diagram that clearly identifies all in-scope systems, data flows involving cardholder data, and segmentation boundaries. This documentation is required by PCI-DSS regardless of penetration testing and will directly inform the test scope.

2. Complete Vulnerability Scans First

Penetration testing is most effective when known, easily-patched vulnerabilities have already been addressed. Run internal and external vulnerability scans (also required under PCI-DSS Requirement 11.3) and remediate critical and high findings before your pen test engagement begins. This ensures testers focus on deeper, more complex attack paths rather than low-hanging fruit.

3. Establish a Remediation Workflow

Have a clear internal process for triaging, assigning, and tracking remediation of findings. PCI-DSS requires that exploitable vulnerabilities be corrected and re-tested — without a defined workflow, this process can stall and leave your organization exposed.

4. Centralize Your Compliance Evidence

Penetration test reports, remediation records, and re-test confirmations must be retained and made available during assessments. Platforms like ComplyGuard allow SMBs to centralize all compliance evidence — including penetration testing documentation — in a single audit-ready repository, eliminating the last-minute scramble that derails so many compliance reviews.

Penetration Testing Frequency: When "Annual" Isn't Enough

While annual testing satisfies the baseline PCI-DSS requirement, the standard also mandates penetration testing after any significant infrastructure or application upgrade or change. For SMBs that frequently update their e-commerce platforms, migrate to cloud infrastructure, or onboard new payment integrations, this can mean multiple tests per year.

Common triggers for out-of-cycle penetration testing include:

• Migration to a new payment gateway or processor
• Launch of a new web application or major feature update
• Cloud migration or significant infrastructure redesign
• Addition of new network segments or third-party integrations touching the CDE
• Discovery of a security incident or suspected breach

Building penetration testing into your change management process — rather than treating it as a standalone annual event — is a hallmark of mature security programs. If you're unsure how to structure this operationally, see how ComplyGuard compares to traditional compliance approaches and how automation can help you stay continuously audit-ready.

Common Mistakes SMBs Make with PCI-DSS Penetration Testing

• Confusing vulnerability scanning with penetration testing. Automated scans identify known vulnerabilities; penetration tests actively exploit them to demonstrate real-world risk. Both are required, and neither substitutes for the other.
• Failing to test segmentation controls. Many SMBs implement network segmentation to reduce scope but never formally validate that it works. This is both a compliance gap and a serious security risk.
• Not retaining test reports. PCI-DSS requires that penetration test results be retained for at least the most recent test cycle. Losing or misplacing reports is a common audit failure point.
• Treating remediation as optional. Identifying vulnerabilities without fixing them provides no security benefit and does not satisfy PCI-DSS requirements. Remediation and re-testing are mandatory, not optional follow-ups.
• Using unqualified internal staff. While internal testers are permitted, they must be organizationally independent from the systems being tested and must demonstrate sufficient qualifications. Most SMBs are better served by qualified external providers.

For additional guidance on building a holistic security testing program, the PCI SSC Document Library provides supplemental guidance documents specifically addressing penetration testing methodology and scoping.

Conclusion

Meeting PCI-DSS penetration testing requirements in 2025 demands more than scheduling an annual test and filing the report. Under PCI-DSS v4.0, SMBs must maintain documented methodologies, validate segmentation controls, address application-layer vulnerabilities, and ensure qualified testers are conducting assessments — all while managing the operational realities of running a growing business. The good news is that with the right processes and tools in place, compliance doesn't have to be a burden. ComplyGuard was built specifically to help SMBs like yours automate evidence collection, track remediation workflows, and stay continuously audit-ready across PCI-DSS and beyond — without the cost of a full-time compliance team or expensive consultants. Talk to our team today or explore our pricing to see how ComplyGuard can help you meet your PCI-DSS obligations faster, smarter, and with far less stress.