PCI DSS Network Segmentation and Segmentation Penetration Testing

What Official Guidance Says

Network segmentation (isolating the CDE from the rest of the network) is not a PCI DSS requirement, but is strongly recommended to reduce assessment scope, cost, control burden, and risk. Without adequate segmentation (a "flat network"), the entire network is in scope. Adequate segmentation means an out-of-scope system could not impact CHD/SAD security even if compromised.

Requirement 11.4.5 (If Segmentation Is Used)

Penetration tests on segmentation controls must be performed:

• At least once every 12 months and after any changes to segmentation controls/methods
• Covering all segmentation controls/methods in use
• Confirming controls are operational and effective and isolate the CDE from all out-of-scope systems
• By a qualified internal resource or qualified external third party with organizational independence (not required to be a QSA or ASV)

Requirement 11.4.6 (Service Providers Only)

Same segmentation penetration-testing expectations on a six-month cadence (and after changes) for service providers.

Assessor Verification

If segmentation is used to reduce the scope of the PCI DSS assessment, the assessor must verify that segmentation is adequate to reduce scope.

How CyberSilo Helps

• Continuous monitoring of segmentation boundaries (firewall/NSC telemetry in ThreatHawk)
• Evidence cadence for 11.4.5 / 11.4.6
• CSA tracking of scope diagrams and change tickets tied to retests

Frequently Asked Questions

Is segmentation mandatory?

No - but without it, expect a much larger CDE and assessment scope.

How often must we test segmentation?

At least annually under 11.4.5; service providers at least every six months under 11.4.6; and after segmentation changes.

Does a passing ASV scan prove segmentation?

No. ASV is external vulnerability scanning (11.3.2). Segmentation proof is penetration testing of isolation controls (11.4.5 / 11.4.6).

Related PCI Resources

Requirement 11 · Requirement 1 · ASV scans · QSA vs ISA vs ASV · PCI hub