PCI DSS Penetration Testing Checklist

Map all systems that store, process, or transmit cardholder data and connected systems.

Obtain network diagrams showing CDE segmentation from non-CDE environments.

PCI DSS requires testing from both inside and outside the network perimeter.

Ensure the testing team is organizationally independent and has appropriate certifications.

Map the complete lifecycle of cardholder data from entry to storage or transmission.

Test connectivity from every non-CDE segment to CDE systems on all ports.

Validate that only documented and required traffic is permitted between segments.

Test that wireless networks cannot route traffic to cardholder data systems.

Verify that vendor VPN and remote access connections are isolated from the CDE.

Confirm that internet-facing systems cannot directly communicate with CDE systems.

Verify that all payment-related input fields are protected against SQL injection and XSS.

Confirm TLS 1.2+ is used for all transmissions of cardholder data with strong cipher suites.

Verify that card numbers are masked (first six/last four) in all displays and log files.

Verify unique user IDs, strong passwords, and MFA for administrative access to CDE systems.

Confirm that expired cardholder data is securely deleted and cannot be recovered.

Attempt to manipulate transaction amounts, skip verification steps, and replay transactions.

Scan all external IP addresses in the CDE for vulnerabilities as required by ASV scanning.

Attempt exploitation of identified vulnerabilities on servers, databases, and network devices.

Check for unused ports, default services, and unnecessary protocols on all CDE hosts.

Verify that all remote access requires MFA and is logged and monitored.

Perform wireless scanning to detect rogue access points that could bridge into the CDE.

Include industry-accepted methodology reference (PTES, NIST SP 800-115) in the report.

Provide evidence that testing coverage included the entire CDE scope.

Critical and high findings must be remediated and retested before compliance validation.

Document segmentation test results to support PCI DSS scope reduction claims.

Format the report to meet QSA expectations including tester qualifications and methodology.