PCI DSS v4.x wants proof, not a snapshot.
So does a real attacker.
PCI DSS v4.x asks for internal and external penetration testing and segmentation testing across your cardholder-data environment. SpartanX supports that program with a continuous adversary that proves exploitability inside and out, and hands you the evidence. It supports your program and complements your QSA; it does not make you compliant on its own.
Internal and external testing, plus segmentation, on a defined cadence.
Requirement 11.4 of PCI DSS v4.x calls for a documented penetration-testing methodology and internal and external penetration testing at least once every 12 months and after any significant infrastructure or application upgrade or change. Where segmentation is used to keep systems out of scope, Requirement 11.4.5 requires testing the segmentation controls at least once every 12 months and after any change to those controls. Requirement 11.4.6 raises that to at least once every six months for service providers. Requirements 11.3.1 and 11.3.2 add regular internal and external vulnerability scans.Each of 11.4.2, 11.4.3, 11.4.5, and 11.4.6 also requires that the test be performed by a qualified internal resource or a qualified external third party, with organizational independence from the team that builds and runs the environment. The standard states explicitly that the tester is “not required to be a QSA or ASV.”None of this is on a roadmap. Everything in 11.4.1 through 11.4.6 became assessable when v3.2.1 retired, and 11.4.7, the only future-dated requirement in 11.4, lost its best-practice status when the future-dated set became mandatory. There is no grace period left to plan against.
Anyone that stores, processes, or transmits cardholder data.
PCI DSS applies to merchants and service providers that handle payment card data. The cardholder-data environment, the systems connected to it, and the segmentation meant to keep everything else out are all in scope, which is exactly where an adversary looks first.
Test the CDE the way an attacker would, continuously.
Continuous coverage, and evidence that holds up.
Instead of a single annual test that ages the moment it is filed, you get continuous internal and external testing, segmentation proof, and a live evidence trail, so you are examination-ready between assessments, not just the week before one.
Support your PCI DSS v4.x testing program with a continuous adversary.
See how SpartanX proves exploitability across your CDE and hands you the evidence.