PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 11 / c11.5
Efficient Vulnerability ManagementSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c11.5 Internal and external penetration testing

Perform internal and external penetration testing at least annually and after significant changes, including validation of the CDE segmentation controls.

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: Medium Applies to CDE: Yes

Requirement 11

Test Security of Systems and Networks Regularly

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

11.4 External and internal penetration testing is regularly performed
  • 11.4.1 Penetration testing methodology defined and implemented Your responsibility
  • 11.4.2 Internal penetration testing performed per methodology Your responsibility
  • 11.4.3 External penetration testing performed per methodology Your responsibility
  • 11.4.4 Exploitable vulnerabilities from pentests corrected and retested Your responsibility
  • 11.4.5 Segmentation controls tested by penetration testing Covered
  • 11.4.6 Segmentation pentests at least every 6 months (SP only) Covered
  • 11.4.7 Multi-tenant SPs support customer external pentests (SP only) Your responsibility

How to implement on AWS

Define a pentest methodology and engage qualified teams. AWS allows customer penetration testing on permitted services without prior approval (AWS pentesting policy). Validate segmentation (11.4.5) through targeted testing. Track remediation of exploitable findings.

Practical implementation

How this control is implemented in each reference architecture:

Pen-test internally and externally at least annually and after significant changes, and validate that the segmentation actually isolates the CDE.

  1. Define a pen-test methodology (11.4.1) and engage a qualified team for annual internal and external tests.
    Pen-test program
  2. Include a segmentation test (11.4.5) proving out-of-scope networks cannot reach the CDE subnets; note AWS permits testing on approved services without prior approval.
    App/Data tiers (CDE) Amazon VPC
  3. Track exploitable findings to closure and retest.
    Remediation tracking

How to validate: Current internal/external pen-test reports exist with a segmentation test, and exploitable findings are remediated and retested.

Avoid: Skipping the segmentation test. 11.4.5 specifically requires proving isolation; a general pen-test is not enough.

Single-account, 3-tier →

Pen-testing validates the account/OU segmentation boundaries this architecture depends on; test each internet-facing CDE account and the central isolation.

  1. Test each internet-facing CDE account externally and internally on the annual cadence.
    Each internet-facing CDE account
  2. Validate the Transit Gateway / account-boundary isolation as the segmentation test (11.4.5), proving out-of-scope accounts cannot reach the CDE.
    PCI OU boundary Transit Gateway AWS Organizations
  3. Track findings and segmentation results centrally.
    Security tooling / evidence store Amazon S3

How to validate: Each internet-facing CDE account has current pen-test reports, and the segmentation test confirms the OU/Transit Gateway boundaries isolate the CDE.

Avoid: Testing one account and assuming the rest are isolated. Validate the actual account/OU boundaries the design relies on.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineinterview

Testing procedures

  • Examine documentation to verify the penetration-testing methodology covers all required elements (11.4.1).
  • Examine the scope and results of the most recent internal and external penetration tests (11.4.2.a, 11.4.3.a) and verify exploitable findings were corrected (11.4.4).
  • Examine segmentation controls and the most recent test results to verify all segmentation methods are tested (11.4.5.a, 11.4.5.b).

Evidence in AWS

  • Documented pentest methodology (aligned with 11.4.1).
  • Internal and external penetration test reports with remediation tracking.
  • CDE segmentation test results.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 11.4 — Exploitable vulnerabilities and security weaknesses are identified through periodic penetration testing and corrected; segmentation controls, if used, are verified to be effective.

AWS services

AWS (Customer Penetration Testing Policy)

Learning resources

References

  • PCI DSS v4.0.1 Requirement 11.4