11.1 Security testing processes and roles
Requirement 11.1 asks for current policies and procedures for regularly testing the security of systems and networks, and documented roles for scanning, penetration testing and detection.
Requirement 11 Test security regularly
Requirement 11 covers regular security testing: wireless detection, vulnerability scanning, penetration testing, intrusion and change detection, and payment page monitoring. Each page covers one second-level requirement.
11.2 Wireless access point detection
Requirement 11.2 requires testing for wireless access points at least every three months, detecting both authorized and rogue devices, and keeping an inventory of authorized access points with business justification.
11.3 Internal and external vulnerability scanning
Requirement 11.3 covers vulnerability scanning: quarterly authenticated internal scans with high-risk and critical findings fixed, quarterly external scans by a PCI SSC Approved Scanning Vendor, and scans after significant changes.
11.4 Penetration testing
Requirement 11.4 covers penetration testing: a documented methodology, internal and external tests every 12 months and after significant changes, retesting fixes, and segmentation testing every 12 months or six months for service providers.
11.5 Intrusion detection and change detection
Requirement 11.5 requires intrusion detection or prevention at the CDE perimeter and critical points, detection of covert malware channels for service providers, and file integrity monitoring of critical files with at least weekly comparisons.
11.6 Payment page change detection
Requirement 11.6 requires a change- and tamper-detection mechanism that alerts on unauthorized changes to payment page content and security-impacting HTTP headers as received by the consumer's browser.
