Scoping a PCI DSS v4 penetration test

PCI DSS v4.0.1 requirement 11.4 requires external and internal penetration testing at least annually and after significant changes, plus segmentation testing if you rely on segmentation to reduce scope. Most delays we see come from unclear scoping rather than from the testing itself.

Define the CDE boundary first

List every system that stores, processes or transmits cardholder data, then every system that can connect to those systems. The second group, connected-to systems, is in scope for testing and is the one most often left out.

What segmentation testing must show

The test must demonstrate that out-of-scope networks cannot reach the CDE. In practice that means attempting connections from each out-of-scope segment to CDE hosts on all ports, not only the ones you expect to be open, and documenting the results.

# from a host in each out-of-scope segment, against every CDE range
sudo nmap -Pn -sS -sU -p- --min-rate 2000 -oA seg-corp-to-cde 10.20.0.0/24

# expected result
All 131070 scanned ports on 10.20.0.0/24 are filtered

Segmentation check: full TCP and UDP port sweep from an out-of-scope segment.

Record the source segment, destination range, date, tester and result for each run. A one-line table per segment pair is what assessors expect to see:

source          destination         ports   result     date        tester
corp-users      cde-app 10.20.0/24  all     filtered   2026-08-12  J. Novak
corp-users      cde-db  10.20.1/24  all     filtered   2026-08-12  J. Novak
guest-wifi      cde-app 10.20.0/24  all     filtered   2026-08-12  J. Novak
devops-jump     cde-app 10.20.0/24  22      OPEN       2026-08-12  J. Novak   <- finding

Segmentation evidence table (an open port from a connected-to system becomes a finding).

• Merchants: at least annually and after changes.
• Service providers: at least every six months (requirement 11.4.6).

Evidence your QSA will ask for

• The scoping document showing CDE and connected-to systems
• A methodology statement (we reference NIST SP 800-115 and PTES)
• The full technical report with findings, evidence and CVSS scores
• Retest evidence for every exploitable finding
• Tester qualifications and independence statement

Timeline

With a clear scope, a mid-size CDE takes two to three weeks from kickoff to final report, including one retest round. Book the test at least six weeks before your ROC or SAQ deadline.