If segmentation isolates the cardholder data environment, when should penetration testing occur?

• A. Never
• B. Monthly
• C. Annually and after changes to segmentation controls
• D. Biannually

Answer: (C)

Penetration testing verifies that segmentation boundaries truly isolate the cardholder data environment (CDE) from the rest of the network. Because those boundaries can be altered or misconfigured during changes, you must re-check them not just on a fixed schedule but also whenever the segmentation controls are modified. PCI DSS requires penetration testing to be performed at least annually and after changes to segmentation controls, ensuring that any new or adjusted rules, devices, or architectures do not create gaps that could expose the CDE. So, the best timing is annually and after changes to segmentation controls. Monthly or biannual testing isn’t the standard requirement, and never testing would leave the segmentation unverified.