thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Compliance-Based Penetration Testing

Penetration testing performed to satisfy a regulatory or standards requirement, such as PCI DSS or FedRAMP.

Definition

Compliance-driven tests have requirements set by the standard regarding frequency, scope and methodology. PCI DSS v4.0 Requirement 11.4 requires internal and external penetration testing at least annually and after significant changes, plus segmentation testing. These tests may be narrower than objective-based tests.

Example

A merchant commissions an annual PCI DSS test of its cardholder data environment and segmentation controls.

Exam tip

PCI DSS requires segmentation testing at least annually (every six months for service providers).

Related terms