PCI DSS Requirement 11: Vulnerability Scans, ASV, Penetration Testing, and Change Detection (11.6.1)

Requirement Structure

Deep Dives

• 11.2.1 / 11.2.2 - Test for wireless access points at least every three months; detect and identify authorized and unauthorized APs; maintain an inventory of authorized APs with business justification. Applies even when policy prohibits wireless.
• 11.3.1 - Internal vulnerability scans at least every three months; resolve high-risk and critical vulnerabilities per the entity's 6.3.1 rankings; rescan to confirm; performed by qualified personnel with organizational independence (not required to be a QSA or ASV).
• 11.3.1.1 - Manage other applicable (non-high/critical) vulnerabilities based on a 12.3.1 targeted risk analysis (mandatory since 31 March 2025).
• 11.3.1.2 - Internal vulnerability scans via authenticated scanning where systems accept credentials (mandatory since 31 March 2025). Document systems that cannot accept credentials. Not required for post-significant-change scans under 11.3.1.3.
• 11.3.1.3 - Internal scans after any significant change; resolve high-risk/critical; rescan as needed.
• 11.3.2 - External vulnerability scans at least every three months by a PCI SSC Approved Scanning Vendor (ASV); meet ASV Program Guide passing-scan requirements; rescan as needed.
• 11.3.2.1 - External scans after significant change; resolve vulnerabilities scored 4.0 or higher by CVSS; rescan as needed.
• 11.4.1 - Documented penetration testing methodology covering industry approaches, CDE perimeter and critical systems, inside and outside testing, segmentation validation, application-layer testing vs 6.2.4, network-layer coverage, last-12-months threats, risk handling, and retention of results for at least 12 months.
• 11.4.2 / 11.4.3 - Internal and external penetration tests at least every 12 months and after significant infrastructure or application upgrade or change; qualified independent tester.
• 11.4.4 - Correct exploitable findings per 6.3.1 risk assessment; repeat penetration testing to verify corrections.
• 11.4.5 - If segmentation isolates the CDE: annual and post-change segmentation penetration tests confirming isolation (and differing security levels per 2.2.3).
• 11.5.1 - IDS/IPS techniques at the CDE perimeter and critical points; alert personnel to suspected compromises; keep engines, baselines, and signatures current.
• 11.5.2 - Change-detection mechanism (for example file integrity monitoring) on critical files; critical file comparisons at least weekly.
• 11.6.1 - Change-and-tamper detection for payment pages as received by the consumer browser (HTTP headers and contents); evaluate at least once every seven days or periodically per a 12.3.1 TRA (mandatory since 31 March 2025).

How CyberSilo Helps

• Threat Exposure Management - vulnerability and external exposure evidence aligned to Req 11 scanning cycles
• Agentic pentesting - complements annual and post-change penetration testing obligations; see also VAPT for PCI DSS
• Compliance Standards Automation - map scan, pentest, IDS/FIM, and 11.6.1 evidence

Frequently Asked Questions

What is the difference between 6.4.3 and 11.6.1?

6.4.3 manages authorization, integrity, and inventory of payment page scripts loaded in the consumer browser. 11.6.1 adds change-and-tamper detection for payment pages (HTTP headers and contents) as received by the consumer browser.

Do internal vulnerability scans need an ASV?

No. A PCI SSC Approved Scanning Vendor is required for external vulnerability scans under 11.3.2. Internal scans under 11.3.1 need qualified personnel with organizational independence.

Is authenticated internal scanning required?

Yes under 11.3.1.2 for systems that accept credentials (mandatory since 31 March 2025). Systems that cannot accept credentials must be documented. Authenticated scanning is not required for post-significant-change scans under 11.3.1.3.

Related PCI Resources

PCI DSS hub · 12 requirements explained · Requirement 6 · Requirement 10