Penetration testing has been performed within the last 12 months

PCI-DSS 4.0 Req 11.4 requires that internal and external penetration testing is performed at least once every 12 months; Req 11.4.1 requires that testing uses industry-accepted methodologies. An annual penetration test is the only way to verify that your security controls work under real-world attack conditions — automated scanners find known CVEs, but pentesters find business logic flaws, authentication bypasses, and chained exploits that tools miss. ISO 27001:2022 A.8.8 and NIST CA-8 both require periodic security testing. A test report older than 12 months is a direct PCI audit finding.

Engage a third-party penetration tester or a qualified internal team to test the full CDE scope: payment APIs, admin panel, network segmentation, and application logic. Document the results in docs/penetration-tests.md with findings count, severity, and remediation status. Per Req 11.4.1, test against PTES, OWASP Testing Guide, or NIST SP 800-115 methodology.

## Last Test: 2026-01-15
**Vendor:** [Firm Name] | **Scope:** Full CDE + payment APIs
**Critical:** 0 | **High:** 1 (REMEDIATED) | **Medium:** 3 (2 remediated, 1 in progress)
**Next Scheduled:** 2027-01-15

For early-stage projects, a recognized bug bounty program (HackerOne, Bugcrowd) with public scope covering payment endpoints can supplement or precede a formal annual pentest. Reference the test report from docs/pci-compliance.md.