PCI DSS Requirement 11: Testing and Scanning Guide

Published Date: November 6, 2026 Author: Content Team

Category: Blogs Tags: PCI DSS

PCI DSS Requirement 11 explained: quarterly scans, authenticated scanning, penetration testing, IDS, file integrity monitoring, and 11.6.1 payment page tamper detection under v4.0.1.

TL;DR

PCI DSS Requirement 11 requires quarterly wireless and vulnerability scans, annual penetration testing, intrusion detection, weekly file integrity checks and payment page tamper detection.
Since March 31, 2025, internal scans must be authenticated (11.3.1.2), and e-commerce payment pages need change and tamper detection (11.6.1).
In August 2026, PCI SSC revised FAQ 1331. Merchants filing a Report on Compliance now need their acquirer’s agreement before treating 6.4.3 and 11.6.1 as not applicable.

Security controls do not stay effective on their own. New vulnerabilities are disclosed constantly, infrastructure changes, and attackers target e-commerce payment pages with malicious scripts that steal card data in the customer’s browser. The Verizon 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the most common initial access vector, involved in 31% of breaches. PCI DSS Requirement 11 closes that gap with scheduled security testing, which under v4.0.1 now includes authenticated internal scanning and payment page tamper detection.

What Does PCI DSS Requirement 11 Require?

PCI DSS Requirement 11 requires organizations to regularly test the security of systems and networks in and connected to the cardholder data environment (CDE), through wireless detection, vulnerability scanning, penetration testing, intrusion detection, change detection, and payment page monitoring.

The v4.0.1 requirement, titled “Test Security of Systems and Networks Regularly,” has six sections:

Section	Focus	Minimum Frequency
11.1	Policies, procedures, and roles	Kept current and in use
11.2	Wireless access point detection	Every three months
11.3	Internal and external vulnerability scanning	Every three months and after significant change
11.4	Penetration testing and segmentation testing	Every 12 months and after significant change
11.5	Intrusion detection and file change detection	Continuous monitoring, weekly file comparisons
11.6	Payment page change and tamper detection	Every seven days, or per targeted risk analysis

PCI DSS v4.0.1 is the only active version, and its future-dated Requirement 11 items, including 11.3.1.2 and 11.6.1, became mandatory on March 31, 2025.

How Does PCI DSS Requirement 11 Handle Wireless and Vulnerability Scanning?

Requirement 11 requires quarterly wireless detection, quarterly internal and external vulnerability scans, and rescans until high-risk and critical vulnerabilities are resolved.

Wireless Access Point Detection

Requirement 11.2.1 requires testing for the presence of wireless access points, and detection of both authorized and unauthorized devices, at least once every three months. Requirement 11.2.2 requires an inventory of authorized access points with a documented business justification. It applies even without wireless in the CDE, because a rogue access point can create an unmonitored path in.

Internal Vulnerability Scanning

Requirement 11.3.1 requires internal scans at least once every three months, with high-risk and critical vulnerabilities resolved and confirmed through rescans.

Two v4.0.1 additions raise the bar:

11.3.1.1: Vulnerabilities not ranked high-risk or critical must be addressed based on a targeted risk analysis performed under Requirement 12.3.1.
11.3.1.2: Internal scans must use authenticated scanning with sufficient privileges. Systems that cannot accept credentials must be documented, and scan accounts that allow interactive login must be managed under Requirement 8.2.2.

Authenticated scans find missing patches and insecure configurations that unauthenticated scans often miss. Requirement 11.3.1.3 adds internal scans after any significant change.

External Vulnerability Scanning

Requirement 11.3.2 requires external scans at least once every three months by a PCI SSC Approved Scanning Vendor (ASV), with vulnerabilities resolved until the scan meets ASV Program Guide requirements for a passing result. Requirement 11.3.2.1 requires external scans after significant changes, with vulnerabilities scored 4.0 or higher by CVSS resolved.

What Are the PCI DSS Penetration Testing Requirements?

PCI DSS Requirement 11.4 requires a documented penetration testing methodology, internal and external penetration tests at least every 12 months and after significant changes, and retesting to verify that exploitable vulnerabilities have been corrected.

The 11.4.1 methodology must cover the full CDE perimeter and critical systems, test from inside and outside the network, include application-layer and network-layer testing, and retain results for 12 months. A qualified internal resource or third party can perform testing if organizationally independent, and the tester does not need to be a QSA or ASV.

Segmentation testing adds further obligations:

11.4.5: If segmentation is used to isolate the CDE, it must be tested at least every 12 months and after any changes.
11.4.6: Service providers must test segmentation at least every six months.
11.4.7: Multi-tenant service providers must support their customers’ external penetration testing.

How Are Intrusions and Unauthorized Changes Detected?

Requirement 11.5 requires intrusion detection or prevention at the CDE perimeter and at critical points inside it, plus a change-detection mechanism that compares critical files at least weekly.

11.5.1: Intrusion-detection or intrusion-prevention techniques must monitor all traffic at the CDE perimeter and at critical points within the CDE, alert personnel to suspected compromises, and keep engines, baselines, and signatures up to date.
11.5.1.1: Service providers must also detect that alert on or prevent and address covert malware communication channels.
11.5.2: A change-detection mechanism, such as file integrity monitoring, must alert personnel to unauthorized modification of critical files and perform critical file comparisons at least once a week.

These controls depend on Requirement 10 log review, since an unreviewed alert provides little protection.

What Does PCI DSS Requirement 11.6.1 Require?

PCI DSS Requirement 11.6.1 requires a change- and tamper-detection mechanism that alerts personnel to unauthorized modifications to the HTTP headers and contents of payment pages as received by the consumer’s browser, run at least every seven days or at a frequency set by targeted risk analysis.

This requirement targets e-skimming, in which attackers inject malicious JavaScript into checkout pages to capture card data. Because these scripts often load from third parties, server-side controls alone may miss them. Requirement 11.6.1 works alongside Requirement 6.4.3, which requires authorization, integrity checks, and an inventory of scripts loaded on payment pages.

How Have the SAQ A Rules for 11.6.1 Changed?

In January 2025, the PCI Security Standards Council removed 6.4.3 and 11.6.1 from SAQ A and added an eligibility criterion requiring merchants to confirm their site is not susceptible to script attacks. In August 2026, it revised FAQ 1331: merchants completing a Report on Compliance can no longer rely on QSA agreement alone to mark these requirements not applicable. The approach must be agreed with the merchant’s compliance-accepting entity, typically its acquirer.

What Evidence Do QSAs Expect for Requirement 11?

A PCI QSA expects evidence that each activity happened on schedule, covered full scope, and led to remediation.

Quarterly wireless scans and the authorized access point inventory
Four quarters of authenticated internal scans and passing ASV scans, with rescans
Targeted risk analyses for 11.3.1.1 and, where used, 11.6.1
Penetration testing methodology, reports, retests, and segmentation results
IDS/IPS and file integrity monitoring configuration and alert records
Payment page monitoring alerts and investigation records

What Are the Most Common Gaps For Requirement 11?

The most common gaps are missed quarterly scans, unauthenticated internal scans, and incomplete payment page monitoring.

A missed or failed quarter that leaves fewer than four passing ASV scans in the year
Internal scans still running without credentials
No scans or tests after significant infrastructure changes
Segmentation tests performed annually by service providers that need them every six months
Payment page scripts loaded from third parties with no tamper detection

Many of these gaps reflect the operational pressure covered in our article on PCI DSS vulnerability management fatigue.

How Can Organizations Strengthen Compliance for Requirement 11?

Build a testing calendar that covers every quarterly, annual, and change-driven activity, then track remediation to closure with evidence.

Create a 12-month calendar for every scan and test.
Define “significant change” and link it to change management.
Move all internal scanning to authenticated mode and document exceptions.
Complete targeted risk analyses for 11.3.1.1 and 11.6.1 where applicable.
Deploy payment page monitoring and maintain the 6.4.3 script inventory.
Confirm applicability decisions for 6.4.3 and 11.6.1 with your acquirer.

Ampcus Cyber’s PCI DSS compliance services include Requirement 11 gap assessments, CREST-accredited penetration and segmentation testing, and QSA assessment support against v4.0.1.

Making PCI DSS Requirement 11 a Continuous Testing Program

PCI DSS Requirement 11 turns security assurance into a recurring schedule of scans, tests, and monitoring. Organizations that plan testing across the year and track every finding to closure will be better prepared for attackers and assessors alike.

Close your Requirement 11 gaps before your next assessment. Book a PCI DSS readiness assessment with our PCI experts.